Skip to content

/v1/file/upload: Add validation to uploadMeta/updateMeta objects  #100

@stewartie4

Description

@stewartie4

On an upload request to a blobber, there is currently only a presence check on the uploadMeta object; none of the contents of uploadMeta is validated.
This leads to hard to debug issues on subsequent commit requests:

  • If actual_size and/or actual_hash is not present in uploadMeta on upload then the subsequent /v1/connection/commit call will always fail with an invalid write marker as the hash will always mismatch.
    image

  • if connection_id is not present in uploadMeta on upload then the subsequent commit will always fail with file not found, leaking the blobber internal file structure as part of the response (this leaks info to potential attackers)
    image

  • if filename and filepath is not present in uploadMeta on upload then upload will fail with file already exists
    image

Suggested solution:

  • Add validation to uploadMeta/updateMeta objects making the following fields mandatory:
    actual_size
    actual_hash
    connection_id
    filename
    filepath
    And fail fast on the upload call.
  • Ensure we aren't leaking filesystem info or similar back to the user in the event of an error on any endpoint

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions