Skip to content

Commit 697a975

Browse files
gary-singh-filestacksethk4783
authored andcommitted
FS-11939 - Add separate hash encoding for filename and mimetype to address the vulnerability (#597)
* resolve test cases * remove filehash as required from /start response * change filehash to metahash
1 parent 958f0cb commit 697a975

File tree

2 files changed

+18
-1
lines changed

2 files changed

+18
-1
lines changed

src/lib/api/upload/uploaders/s3.spec.ts

+15
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ const testHost = 'https://filestack-test.com';
6565
const mockUploadId = '123132123';
6666
const mockRegion = 'test-region';
6767
const mockedUri = '/sometest';
68+
const mockMetaHash= 'test'
6869
const s3Url = testHost + '/fakes3';
6970

7071
const mockStart = jest.fn().mockName('multipart/start');
@@ -100,6 +101,7 @@ describe('Api/Upload/Uploaders/S3', () => {
100101
region: mockRegion,
101102
upload_id: mockUploadId,
102103
location_url: testHost,
104+
metahash: mockMetaHash,
103105
});
104106

105107
mockUpload.mockReturnValue({
@@ -121,6 +123,7 @@ describe('Api/Upload/Uploaders/S3', () => {
121123
mimetype: 'test_mimetype',
122124
status: 'test_status',
123125
upload_tags: { test: 123 },
126+
metahash: mockMetaHash,
124127
});
125128
});
126129

@@ -224,6 +227,7 @@ describe('Api/Upload/Uploaders/S3', () => {
224227
region: mockRegion,
225228
upload_id: mockUploadId,
226229
location_url: testHost.replace('https://', ''),
230+
metahash: mockMetaHash,
227231
});
228232

229233
const u = new S3Uploader({});
@@ -245,6 +249,7 @@ describe('Api/Upload/Uploaders/S3', () => {
245249
region: mockRegion,
246250
upload_id: mockUploadId,
247251
location_url: testHost.replace('https://', ''),
252+
metahash: mockMetaHash,
248253
});
249254

250255
const u = new S3Uploader({});
@@ -264,6 +269,7 @@ describe('Api/Upload/Uploaders/S3', () => {
264269
region: mockRegion,
265270
upload_id: mockUploadId,
266271
location_url: testHost.replace('https://', ''),
272+
metahash: mockMetaHash,
267273
});
268274

269275
interceptorS3.once().reply(200, s3Callback, {});
@@ -288,6 +294,7 @@ describe('Api/Upload/Uploaders/S3', () => {
288294
upload_id: mockUploadId,
289295
location_region: 'test',
290296
location_url: testHost.replace('https://', ''),
297+
metahash: mockMetaHash,
291298
});
292299

293300
interceptorUpload.reply(200, function(_, data) {
@@ -495,6 +502,7 @@ describe('Api/Upload/Uploaders/S3', () => {
495502
upload_id: mockUploadId,
496503
location_url: testHost,
497504
upload_type: 'intelligent_ingestion',
505+
metahash: mockMetaHash,
498506
});
499507
});
500508

@@ -571,6 +579,7 @@ describe('Api/Upload/Uploaders/S3', () => {
571579
},
572580
fii: true,
573581
uri: mockedUri,
582+
metahash: mockMetaHash,
574583
});
575584
});
576585

@@ -647,6 +656,7 @@ describe('Api/Upload/Uploaders/S3', () => {
647656
},
648657
fii: true,
649658
uri: mockedUri,
659+
metahash: mockMetaHash,
650660
});
651661
});
652662

@@ -732,6 +742,7 @@ describe('Api/Upload/Uploaders/S3', () => {
732742
upload_id: mockUploadId,
733743
location_url: testHost,
734744
upload_type: 'intelligent_ingestion',
745+
metahash: mockMetaHash,
735746
});
736747

737748
interceptorS3.reply(400, {
@@ -781,6 +792,7 @@ describe('Api/Upload/Uploaders/S3', () => {
781792
upload_id: mockUploadId,
782793
location_url: testHost,
783794
upload_type: 'intelligent_ingestion',
795+
metahash: mockMetaHash,
784796
});
785797

786798
let networkFail = true;
@@ -847,6 +859,7 @@ describe('Api/Upload/Uploaders/S3', () => {
847859
region: mockRegion,
848860
upload_id: mockUploadId,
849861
location_url: testHost,
862+
metahash: mockMetaHash,
850863
});
851864

852865
let networkFail = true;
@@ -948,6 +961,7 @@ describe('Api/Upload/Uploaders/S3', () => {
948961
location: DEFAULT_STORE_LOCATION,
949962
},
950963
uri: mockedUri,
964+
metahash: mockMetaHash,
951965
});
952966

953967
expect(res[0].handle).toEqual('test_handle');
@@ -1021,6 +1035,7 @@ describe('Api/Upload/Uploaders/S3', () => {
10211035
location: DEFAULT_STORE_LOCATION,
10221036
},
10231037
uri: mockedUri,
1038+
metahash: mockMetaHash,
10241039
});
10251040

10261041
expect(res[0].handle).toEqual('test_handle');

src/lib/api/upload/uploaders/s3.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ export interface UploadPayload {
4444
upload_id?: number;
4545
location_url?: string;
4646
location_region?: string;
47+
metahash?: string;
4748
}
4849

4950
export class S3Uploader extends UploaderAbstract {
@@ -213,6 +214,7 @@ export class S3Uploader extends UploaderAbstract {
213214
upload_id: payload.upload_id,
214215
region: payload.region,
215216
alt: payload.file.alt,
217+
metahash: payload.metahash,
216218
};
217219

218220
if (this.uploadMode === UploadMode.INTELLIGENT || (this.uploadMode === UploadMode.FALLBACK && fiiFallback)) {
@@ -688,7 +690,7 @@ export class S3Uploader extends UploaderAbstract {
688690
return FsRequest.post(
689691
`${this.getUploadUrl(id)}/multipart/complete`,
690692
{
691-
...this.getDefaultFields(id, ['apikey', 'policy', 'signature', 'uri', 'region', 'upload_id', 'fii', 'alt'], true),
693+
...this.getDefaultFields(id, ['apikey', 'policy', 'signature', 'uri', 'region', 'upload_id', 'fii', 'alt', 'metahash'], true),
692694
// method specific keys
693695
filename: payload.file.name,
694696
mimetype: payload.file.type,

0 commit comments

Comments
 (0)