Fixes security issue: potential remote Path Traversal via File Upload

This commit is contained in:
kfj001 committed 2026-07-19 05:55:58 +00:00
1 parent 4a65c7562f
commit 39b3e633a6
10 files changed
+211 -145

No files matched your search

+6 -3
View File
@@ -8,7 +8,6 @@ import {
MobileBuildDefaults,
MobileBuildPreflightResult,
MobileBuildRequest,
MobileBuildUploadedFile,
ThemeStatus,
} from '../interfaces/mobile-build';
@@ -35,19 +34,23 @@ export class MobileBuildService {
return this.http.post<MobileBuildRequest>(`${this.baseUrl}/requests`, payload);
}
deleteRequest(id: number): Observable<void> {
return this.http.delete<void>(`${this.baseUrl}/requests/${id}`);
}
uploadFile(
requestId: number,
platform: 'android' | 'ios',
fileKind: string,
file: File,
): Observable<MobileBuildUploadedFile> {
): Observable<{ platform: string; file_kind: string; display_name: string; sha256: string; size: number }> {
const form = new FormData();
form.append('file', file);
const params = new HttpParams()
.set('platform', platform)
.set('file_kind', fileKind);
return this.http.post<MobileBuildUploadedFile>(
return this.http.post<{ platform: string; file_kind: string; display_name: string; sha256: string; size: number }>(
`${this.baseUrl}/requests/${requestId}/files`,
form,
{ params },