Merge pull request #5 from ImageMarkup/lockdown-zipstreamer

Author: danlamanna

zip_streamer/server.go

@@ -41,10 +41,15 @@ func NewServer() *Server {
 
 	sentryHandler := sentryhttp.New(sentryhttp.Options{})
 
-	r.HandleFunc("/download", server.HandlePostDownload).Methods("POST")
+	//r.HandleFunc("/download", server.HandlePostDownload).Methods("POST")
+	//r.HandleFunc("/create_download_link", server.HandleCreateLink).Methods("POST")
+	//r.HandleFunc("/download_link/{link_id}", server.HandleDownloadLink).Methods("GET")
+	/*
+		NOTE: Given that the zipstreamer server has unlimited access to private data, we have to disable every endpoint
+		that could allow users with the correct URLs to private data to exfiltrate it through the zipstreamer service.
+		This also includes modifying the server.HandleGetDownload such that it *only* supports listfile IDs, and not URLs.
+	*/
 	r.HandleFunc("/download", sentryHandler.HandleFunc(server.HandleGetDownload)).Methods("GET")
-	r.HandleFunc("/create_download_link", server.HandleCreateLink).Methods("POST")
-	r.HandleFunc("/download_link/{link_id}", server.HandleDownloadLink).Methods("GET")
 
 	return &server
 }
@@ -102,11 +107,9 @@ func (s *Server) HandlePostDownload(w http.ResponseWriter, req *http.Request) {
 
 func (s *Server) HandleGetDownload(w http.ResponseWriter, req *http.Request) {
 	params := req.URL.Query()
-	listfileUrl := params.Get("zsurl")
 	listFileId := params.Get("zsid")
-	if listfileUrl == "" && s.ListfileUrlPrefix != "" && listFileId != "" {
-		listfileUrl = s.ListfileUrlPrefix + listFileId
-	}
+	listfileUrl := s.ListfileUrlPrefix + listFileId
+
 	if listfileUrl == "" {
 		w.WriteHeader(http.StatusBadRequest)
 		w.Write([]byte(`{"status":"error","error":"invalid parameters"}`))

zip_streamer/zip_streamer.go

@@ -61,7 +61,7 @@ func getS3Object(urlStr string) (*http.Response, error) {
 	// Extract bucket name from hostname (bucket.s3.region.amazonaws.com format)
 	host := parsedURL.Host
 	key := strings.TrimPrefix(parsedURL.Path, "/")
-	
+
 	parts := strings.Split(host, ".")
 	bucket := parts[0]
 
@@ -73,7 +73,7 @@ func getS3Object(urlStr string) (*http.Response, error) {
 	if region == "" {
 		region = "us-east-1"
 	}
-	
+
 	cfg, err := config.LoadDefaultConfig(context.TODO(),
 		config.WithRegion(region),
 	)
@@ -116,7 +116,7 @@ func retryableGet(urlStr string) (*http.Response, error) {
 		sleepDuration = time.Duration(math.Min(math.Pow(float64(2), float64(i)), float64(30))) * time.Second
 
 		var resp *http.Response
-		
+
 		if isS3URL {
 			resp, err = getS3Object(urlStr)
 		} else {