diff options
Diffstat (limited to 'src/routes')
| -rw-r--r-- | src/routes/api.ts | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/src/routes/api.ts b/src/routes/api.ts index 798fb27..f17b179 100644 --- a/src/routes/api.ts +++ b/src/routes/api.ts @@ -155,16 +155,29 @@ api.route('/actuate') return res.status(405).json({ error: 'Method not allowed.' }); }); - +/* + Download the CSV file after running the pendulum + GET /api/v1/download + Parameters: + filename: The name of the file to download + Returns: + 200: (the CSV file) + 403 when someone is trying to do directory traversal + 404 when the file is not accessible or does not exist + 500 for any other errors +*/ api.route('/download') .get(csrf, async (req: Request, res: Response) => { - const path: string = `/tmp/${req.query.filename}.csv` as string; - + const filename: string = req.query.filename as string; + if (!filename) + return res.status(400).json({ error: 'No filename specified.' }); // Make sure no path traversal is attempted // This regex matches all alphanumeric characters, underscores, and dashes. // MAKE SURE THIS DOES NOT ALLOW PATH TRAVERSAL - if (/^[\w-]+$/.test(path)) - return res.status(403).json({ error: 'Get lost' }); + if (!/^[\w-]+$/.test(filename)) + return res.status(403).json({ error: 'No.' }); + + const path = `/tmp/${filename}.csv`; // Verify that the file exists and is a regular file // Return if not since the res will be sent by the verifyFile function @@ -198,7 +211,7 @@ async function verifyFile(file: string, res: Response) { try { await access(file); } catch (err) { - res.status(403).json({ error: 'File is not accessible or does not exist.' }); + res.status(404).json({ error: 'File is not accessible or does not exist.' }); return false; } // This is a try catch because otherwise type checking will fail and get all messed up |