Fixes security issue: potential remote Path Traversal via File Upload
This commit is contained in:
1 parent
4a65c7562f
commit
39b3e633a6
10 files changed
+211
-145
No files matched your search
@@ -8,7 +8,6 @@ import {
|
||||
MobileBuildDefaults,
|
||||
MobileBuildPreflightResult,
|
||||
MobileBuildRequest,
|
||||
MobileBuildUploadedFile,
|
||||
ThemeStatus,
|
||||
} from '../interfaces/mobile-build';
|
||||
|
||||
@@ -35,19 +34,23 @@ export class MobileBuildService {
|
||||
return this.http.post<MobileBuildRequest>(`${this.baseUrl}/requests`, payload);
|
||||
}
|
||||
|
||||
deleteRequest(id: number): Observable<void> {
|
||||
return this.http.delete<void>(`${this.baseUrl}/requests/${id}`);
|
||||
}
|
||||
|
||||
uploadFile(
|
||||
requestId: number,
|
||||
platform: 'android' | 'ios',
|
||||
fileKind: string,
|
||||
file: File,
|
||||
): Observable<MobileBuildUploadedFile> {
|
||||
): Observable<{ platform: string; file_kind: string; display_name: string; sha256: string; size: number }> {
|
||||
const form = new FormData();
|
||||
form.append('file', file);
|
||||
const params = new HttpParams()
|
||||
.set('platform', platform)
|
||||
.set('file_kind', fileKind);
|
||||
|
||||
return this.http.post<MobileBuildUploadedFile>(
|
||||
return this.http.post<{ platform: string; file_kind: string; display_name: string; sha256: string; size: number }>(
|
||||
`${this.baseUrl}/requests/${requestId}/files`,
|
||||
form,
|
||||
{ params },
|
||||
|
||||
Reference in new issue
Block a user