diff --git a/app/controllers/api/storage.php b/app/controllers/api/storage.php index 9eb3e9b8de..ae4728dbc6 100644 --- a/app/controllers/api/storage.php +++ b/app/controllers/api/storage.php @@ -30,6 +30,8 @@ use Utopia\Validator\Range; use Utopia\Validator\Text; use Utopia\Validator\WhiteList; +use function PHPUnit\Framework\isNull; + App::post('/v1/storage/buckets') ->desc('Create storage bucket') ->groups(['api', 'storage']) @@ -1067,9 +1069,12 @@ App::get('/v1/storage/buckets/:bucketId/files/:fileId/download') list($unit, $range) = explode('=', $rangeHeader); if($unit == 'bytes' && !empty($range)) { list($rangeStart, $rangeEnd) = explode('-', $range); + if(strlen($rangeStart) == 0 || strlen($rangeEnd) == 0) { + throw new Exception('Invalid range', 400); + } $rangeStart = (int) $rangeStart; $rangeEnd = (int) $rangeEnd; - if(($rangeStart > $rangeEnd) || $rangeEnd > $size) { + if(($rangeStart >= $rangeEnd) || $rangeEnd > $size) { throw new Exception('Invalid range', 400); } diff --git a/tests/e2e/Services/Storage/StorageBase.php b/tests/e2e/Services/Storage/StorageBase.php index 137c50a576..53749b3f9c 100644 --- a/tests/e2e/Services/Storage/StorageBase.php +++ b/tests/e2e/Services/Storage/StorageBase.php @@ -297,7 +297,34 @@ trait StorageBase $this->assertEquals('image/png', $file51['headers']['content-type']); $this->assertNotEmpty($file51['body']); $this->assertEquals($originalChunk, $file51['body']); - + + // Test ranged download - with invalid range + $file52 = $this->client->call(Client::METHOD_GET, '/storage/buckets/' . $bucketId . '/files/' . $data['fileId'] . '/download', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'Range' => 'bytes=0-', + ], $this->getHeaders())); + + $this->assertEquals(400, $file52['headers']['status-code']); + + // Test ranged download - with invalid range + $file53 = $this->client->call(Client::METHOD_GET, '/storage/buckets/' . $bucketId . '/files/' . $data['fileId'] . '/download', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'Range' => 'bytes=988', + ], $this->getHeaders())); + + $this->assertEquals(400, $file53['headers']['status-code']); + + // Test ranged download - with invalid range + $file54 = $this->client->call(Client::METHOD_GET, '/storage/buckets/' . $bucketId . '/files/' . $data['fileId'] . '/download', array_merge([ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'Range' => 'bytes=-988', + ], $this->getHeaders())); + + $this->assertEquals(400, $file54['headers']['status-code']); + $file6 = $this->client->call(Client::METHOD_GET, '/storage/buckets/' . $bucketId . '/files/' . $data['fileId'] . '/view', array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'],