mirrors/puter
1
0
Fork 0
mirror of https://github.com/HeyPuter/puter synced 2024-11-14 22:06:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disallow negative size values

Browse Source
This commit is contained in:
KernelDeimos 2024-05-21 18:46:34 -04:00
parent 90463a0732
commit 1f6a2093fb
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
packages/backend/src/api/APIError.js
View File

@ -220,6 +220,10 @@ module.exports = class APIError {
status: 400,
message: 'Missing fileinfo entry or BLOB for operation.',
},
'invalid_file_metadata': {
status: 400,
message: 'Invalid file metadata.',
},
// Open
'no_suitable_app': {

6
packages/backend/src/routers/filesystem_api/batch/all.js
View File

@ -192,7 +192,11 @@ module.exports = eggspress('/batch', {
}
if ( fieldname === 'fileinfo' ) {
fileinfos.push(JSON.parse(value));
const fileinfo = JSON.parse(value);
if ( fileinfo.size < 0 ) {
throw APIError.create('invalid_file_metadata');
}
fileinfos.push(fileinfo);
return;
}