DownloadClusterFiles: verify file name
Using the available cluster file names from the previews commit,
verify that the given file in DownloadClusterFiles is valid name.
@@ -17,6 +17,8 @@ import (
"text/template"
"time"
+ "github.com/thoas/go-funk"
+
"github.com/danielerez/go-dns-client/pkg/dnsproviders"
"github.com/filanov/bm-inventory/internal/cluster"
"github.com/filanov/bm-inventory/internal/cluster/validations"
@@ -1487,6 +1489,12 @@ func (b *bareMetalInventory) DownloadClusterFiles(ctx context.Context, params in
var cluster common.Cluster
log.Infof("Download cluster files: %s for cluster %s", params.FileName, params.ClusterID)
+ if !funk.Contains(clusterFileNames, params.FileName) {
+ err := fmt.Errorf("invalid cluster file %s", params.FileName)
+ log.WithError(err).Errorf("failed download file: %s from cluster: %s", params.FileName, params.ClusterID)
+ return common.NewApiError(http.StatusBadRequest, err)
+ }
+
if err := b.db.First(&cluster, "id = ?", params.ClusterID).Error; err != nil {
log.WithError(err).Errorf("failed to find cluster %s", params.ClusterID)
if gorm.IsRecordNotFoundError(err) {
