From 0bad308c9cffd8db53f99f3beb86606ddafec40e Mon Sep 17 00:00:00 2001
From: Mawoka <mawoka@e.email>
Date: Sat, 2 Apr 2022 20:20:59 +0200
Subject: [PATCH] :ambulance: Regex was after downloading (security issue)

---
 classquiz/routers/storage.py      | 5 ++++-
 classquiz/storage/__init__.py     | 2 +-
 classquiz/storage/deta_storage.py | 8 ++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/classquiz/routers/storage.py b/classquiz/routers/storage.py
index a995d15..e2a403f 100644
--- a/classquiz/routers/storage.py
+++ b/classquiz/routers/storage.py
@@ -15,10 +15,13 @@ file_regex = r"^[a-z0-9]{8}-[a-z0-9-]{27}--[a-z0-9-]{36}$"
 async def download_file(file_name: str):
     storage = Storage(backend=settings.storage_backend, deta_key=settings.deta_project_key,
                       deta_id=settings.deta_project_id, storage_path=settings.storage_path)
-    download = await storage.download(file_name)
     if not re.match(file_regex, file_name):
         raise HTTPException(status_code=400, detail="Invalid file name")
 
+    download = await storage.download(file_name)
+    if download is None:
+        raise HTTPException(status_code=404, detail="File not found")
+
     def iter_file():
         yield from download
 
diff --git a/classquiz/storage/__init__.py b/classquiz/storage/__init__.py
index 11f54fd..4d3e63a 100644
--- a/classquiz/storage/__init__.py
+++ b/classquiz/storage/__init__.py
@@ -14,7 +14,7 @@ class Storage:
         if backend == "deta":
             if deta_key is None or deta_id is None:
                 raise ValueError("deta_key and deta_id must be provided")
-        if backend == "local":
+        elif backend == "local":
             if storage_path is None:
                 raise ValueError("storage_path must be provided")
         else:
diff --git a/classquiz/storage/deta_storage.py b/classquiz/storage/deta_storage.py
index 7fa929b..5921abd 100644
--- a/classquiz/storage/deta_storage.py
+++ b/classquiz/storage/deta_storage.py
@@ -41,3 +41,11 @@ class DetaStorage:
                     return None
                 else:
                     raise Exception("Upload failed")
+
+    async def delete(self, file_name: [str]) -> None:
+        async with ClientSession(headers=self.headers) as session:
+            async with session.delete(f"{self.deta_url}/files/delete", data={"names": file_name}) as response:
+                if response.status == 200:
+                    return None
+                else:
+                    raise Exception("Delete failed")
\ No newline at end of file