Return BadRequest for invalid parameter (#10064)

Author: liliankasem

src/WebJobs.Script.WebHost/Controllers/ExtensionsController.cs

@@ -67,6 +67,12 @@ public async Task<IActionResult> Get()
         [Route("admin/host/extensions/{id}")]
         public async Task<IActionResult> Delete(string id)
         {
+            // We are using a file name check, but the API expects a NuGet package name/ID
+            if (!FileUtility.IsValidFileName(id))
+            {
+                return BadRequest();
+            }
+
             if (_extensionBundleManager.IsExtensionBundleConfigured())
             {
                 return BadRequest(Resources.ExtensionBundleBadRequestDelete);
@@ -92,6 +98,11 @@ await _extensionsManager.DeleteExtensions(id)
         [Route("admin/host/extensions/jobs/{id}")]
         public async Task<IActionResult> GetJobs(string id)
         {
+            if (!IsValidGuid(id))
+            {
+                return BadRequest();
+            }
+
             ExtensionsRestoreJob job = await GetJob(id);
 
             if (job == null)
@@ -258,5 +269,10 @@ private async Task<IEnumerable<ExtensionsRestoreJob>> GetInProgressJobs()
 
             return jobs;
         }
+
+        private bool IsValidGuid(string value)
+        {
+            return Guid.TryParse(value, out _);
+        }
     }
 }

src/WebJobs.Script/Extensions/FileUtility.cs

@@ -5,6 +5,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.IO.Abstractions;
+using System.Linq;
 using System.Reflection;
 using System.Text;
 using System.Threading.Tasks;
@@ -13,6 +14,7 @@ namespace Microsoft.Azure.WebJobs.Script
 {
     public static class FileUtility
     {
+        private static readonly char[] InvalidFileNameChars = Path.GetInvalidFileNameChars();
         private static IFileSystem _default = new FileSystem();
         private static IFileSystem _instance;
 
@@ -282,5 +284,30 @@ private static void DoSafeAction(Action action, bool ignoreErrors)
             {
             }
         }
+
+        /// <summary>
+        /// Checks if a file name is valid.
+        /// </summary>
+        /// <param name="input">The string to sanitize.</param>
+        /// <returns>Boolean value determining if file name is valid or not.</returns>
+        public static bool IsValidFileName(string fileName)
+        {
+            if (string.IsNullOrEmpty(fileName))
+            {
+                return false;
+            }
+
+            if (fileName.Contains("..") || Path.IsPathRooted(fileName))
+            {
+                return false;
+            }
+
+            if (fileName.Contains(Path.DirectorySeparatorChar) || fileName.Contains(Path.AltDirectorySeparatorChar))
+            {
+                return false;
+            }
+
+            return fileName.IndexOfAny(InvalidFileNameChars) >= 0 ? false : true;
+        }
     }
 }

test/WebJobs.Script.Tests/IO/FileUtilityTests.cs

@@ -1,11 +1,7 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the MIT License. See License.txt in the project root for license information.
 
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using System.Threading.Tasks;
+using System.IO;
 using Xunit;
 
 namespace Microsoft.Azure.WebJobs.Script.Tests.IO
@@ -23,5 +19,22 @@ public void GetRelativePath_ReturnsExpectedPath(string path1, string path2, stri
 
             Assert.Equal(expectedPath, result);
         }
+
+        [Theory]
+        [InlineData("file/name", false)]
+        [InlineData("file\0name", false)]
+        [InlineData("file\\name", false)]
+        [InlineData("..\\..\\filename", false)]
+        [InlineData("../../filename", false)]
+        [InlineData("..filename", false)]
+        [InlineData("filename", true)]
+        [InlineData("file-name", true)]
+        [InlineData("file_name", true)]
+        [InlineData("filename123", true)]
+        public void IsValidFileName_ReturnsBool(string input, bool expectedOutput)
+        {
+            var result = FileUtility.IsValidFileName(input);
+            Assert.Equal(expectedOutput, result);
+        }
     }
 }