🚑 Regex was after downloading (security issue)

2022-04-02 20:20:59 +02:00
parent 385f8be1da
commit 0bad308c9c
3 changed files with 13 additions and 2 deletions
@@ -15,10 +15,13 @@ file_regex = r"^[a-z0-9]{8}-[a-z0-9-]{27}--[a-z0-9-]{36}$"
 async def download_file(file_name: str):
    storage = Storage(backend=settings.storage_backend, deta_key=settings.deta_project_key,
                      deta_id=settings.deta_project_id, storage_path=settings.storage_path)
-    download = await storage.download(file_name)
    if not re.match(file_regex, file_name):
        raise HTTPException(status_code=400, detail="Invalid file name")

+    download = await storage.download(file_name)
+    if download is None:
+        raise HTTPException(status_code=404, detail="File not found")
+
    def iter_file():
        yield from download