Avoid non-blob webresources fields on multipart requests #746
Conversation
| @@ -151,7 +157,9 @@ export const getUploaderMiddlware = ( | |||
| completeUploads.push( | |||
| (async () => { | |||
| try { | |||
| if (!(await isFileInValidPath(fieldname, req))) { | |||
| if ( | |||
| !(await isFileInValidPath(fieldname, req, parsedOdataRequest)) | |||
There was a problem hiding this comment.
As a later improvement there's a lot of work done in isFileInValidPath that would be nice to avoid duplicating if there are multiple uploads in a single request. I don't know if the duplication is avoidable but I suspect so
There was a problem hiding this comment.
Added in my todo list for webresources
| @@ -67,6 +67,7 @@ export const getWebresourceHandler = (): WebResourceHandler | undefined => { | |||
| const isFileInValidPath = async ( | |||
| fieldname: string, | |||
| req: Express.Request, | |||
| odataRequest: uriParser.ParsedODataRequest, | |||
| ): Promise<boolean> => { | |||
| if (req.method !== 'POST' && req.method !== 'PATCH') { | |||
There was a problem hiding this comment.
Do we allow multipart requests on requests that aren't POST/PATCH?
There was a problem hiding this comment.
@Page- We don't do anything, basically. Whatever is the content of multpart/body in those requests is just dropped. IMHO it is the expected behaviour as it is the same thing of a GET request with a body (it works, but the body is just ignored as it should not be there).
otaviojacobi
force-pushed
the
avoids-string-multipart-webresources-fields
branch
from
08b91f1 to
be666fc
Compare
otaviojacobi
force-pushed
the
avoids-string-multipart-webresources-fields
branch
3 times, most recently
from
a5f6022 to
abb6980
Compare
Change-type: patch
otaviojacobi
force-pushed
the
avoids-string-multipart-webresources-fields
branch
from
abb6980 to
a7dfa37
Compare
Change-type: patch