Disallow negative size values

HeyPuter · May 21, 2024 · 1f6a209 · 1f6a209
1 parent 90463a0
commit 1f6a209
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/packages/backend/src/api/APIError.js b/packages/backend/src/api/APIError.js
@@ -220,6 +220,10 @@ module.exports = class APIError {
             status: 400,
             message: 'Missing fileinfo entry or BLOB for operation.',
         },
+        'invalid_file_metadata': {
+            status: 400,
+            message: 'Invalid file metadata.',
+        },
 
         // Open
         'no_suitable_app': {

diff --git a/packages/backend/src/routers/filesystem_api/batch/all.js b/packages/backend/src/routers/filesystem_api/batch/all.js
@@ -192,7 +192,11 @@ module.exports = eggspress('/batch', {
             }
 
             if ( fieldname === 'fileinfo' ) {
-                fileinfos.push(JSON.parse(value));
+                const fileinfo = JSON.parse(value);
+                if ( fileinfo.size < 0 ) {
+                    throw APIError.create('invalid_file_metadata');
+                }
+                fileinfos.push(fileinfo);
                 return;
             }