Signal/Signal-Server
1
0
Fork 0
mirror of https://github.com/signalapp/Signal-Server synced 2026-04-20 03:08:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add source length validation on backup media copy

Browse Source
This commit is contained in:
Ravi Khadiwala
2024-08-14 16:48:13 -05:00
committed by ravi-signal
parent 6cdfb7ab63
commit fd10b9723d
3 changed files with 37 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
service/src/main/java/org/whispersystems/textsecuregcm/backup/BackupManager.java
View File

@@ -273,7 +273,7 @@ public class BackupManager {
final List<CopyParameters> toCopy) {
final long totalBytesAdded = toCopy.stream()
.mapToLong(copyParameters -> {
if (copyParameters.sourceLength() > MAX_MEDIA_OBJECT_SIZE) {
if (copyParameters.sourceLength() > MAX_MEDIA_OBJECT_SIZE || copyParameters.sourceLength() < 0) {
throw Status.INVALID_ARGUMENT
.withDescription("Invalid sourceObject size")
.asRuntimeException();

4
service/src/main/java/org/whispersystems/textsecuregcm/controllers/ArchiveController.java
View File

@@ -34,6 +34,7 @@ import javax.validation.constraints.Max;
import javax.validation.constraints.Min;
import javax.validation.constraints.NotBlank;
import javax.validation.constraints.NotNull;
import javax.validation.constraints.PositiveOrZero;
import javax.validation.constraints.Size;
import javax.ws.rs.BadRequestException;
import javax.ws.rs.ClientErrorException;
@@ -479,6 +480,7 @@ public class ArchiveController {
@Schema(description = "The length of the source attachment before the encryption applied by the copy operation")
@NotNull
@PositiveOrZero
int objectLength,
@Schema(description = "mediaId to copy on to the backup CDN, encoded in URL-safe padded base64", implementation = String.class)
@@ -575,7 +577,7 @@ public class ArchiveController {
@Schema(description = "A list of media objects to copy from the attachments CDN to the backup CDN")
@NotNull
@Size(min = 1, max = 1000)
List<CopyMediaRequest> items) {}
List<@Valid CopyMediaRequest> items) {}
public record CopyMediaBatchResponse(