-
Notifications
You must be signed in to change notification settings - Fork 26
Description
On an upload request to a blobber, there is currently only a presence check on the uploadMeta object; none of the contents of uploadMeta is validated.
This leads to hard to debug issues on subsequent commit requests:
-
If actual_size and/or actual_hash is not present in uploadMeta on upload then the subsequent /v1/connection/commit call will always fail with an invalid write marker as the hash will always mismatch.

-
if connection_id is not present in uploadMeta on upload then the subsequent commit will always fail with file not found, leaking the blobber internal file structure as part of the response (this leaks info to potential attackers)

-
if filename and filepath is not present in uploadMeta on upload then upload will fail with file already exists

Suggested solution:
- Add validation to uploadMeta/updateMeta objects making the following fields mandatory:
actual_size
actual_hash
connection_id
filename
filepath
And fail fast on the upload call. - Ensure we aren't leaking filesystem info or similar back to the user in the event of an error on any endpoint