@@ -36,19 +36,7 @@ router.post('/messages', async (req: Request, res, next) => {
3636 let sender = utils . extractPeerSenderFromRequest ( req ) ;
3737 const { senderDestination, recipientDestination, message } = await utils . extractMessageFromMultipartForm ( req ) ;
3838 if ( senderDestination !== undefined ) {
39- if ( sender === peerID ) {
40- if ( ! config . destinations ?. includes ( senderDestination ) ) {
41- throw new RequestError ( `Unknown sender destination expected=${ config . destinations ?. join ( '|' ) ?? 'none' } recieved=${ senderDestination } ` , 404 ) ;
42- }
43- } else {
44- const peer = config . peers . find ( peer => peer . id === sender ) ;
45- if ( peer === undefined ) {
46- throw new RequestError ( `Unknown sender ${ sender } ` , 404 ) ;
47- }
48- if ( ! peer . destinations ?. includes ( senderDestination ) ) {
49- throw new RequestError ( `Unknown sender destination expected=${ peer . destinations ?. join ( '|' ) ?? 'none' } recieved=${ senderDestination } ` , 404 ) ;
50- }
51- }
39+ validateSenderDestination ( sender , senderDestination ) ;
5240 sender += '/' + senderDestination ;
5341 }
5442 let recipient = peerID ;
@@ -76,10 +64,14 @@ router.put('/blobs/*', async (req: Request, res, next) => {
7664 let sender = utils . extractPeerSenderFromRequest ( req ) ;
7765 const { file, senderDestination, recipientDestination } = await utils . extractFileFromMultipartForm ( req ) ;
7866 if ( senderDestination !== undefined ) {
67+ validateSenderDestination ( sender , senderDestination ) ;
7968 sender += '/' + senderDestination ;
8069 }
8170 let recipient = peerID ;
8271 if ( recipientDestination !== undefined ) {
72+ if ( ! config . destinations ?. includes ( recipientDestination ) ) {
73+ throw new RequestError ( `Unknown recipient destination expected=${ config . destinations ?. join ( '|' ) ?? 'none' } recieved=${ recipientDestination } ` , 404 ) ;
74+ }
8375 recipient += '/' + recipientDestination ;
8476 }
8577 const blobPath = path . join ( utils . constants . RECEIVED_BLOBS_SUBDIRECTORY , sender , req . params [ 0 ] ) ;
@@ -99,3 +91,19 @@ router.put('/blobs/*', async (req: Request, res, next) => {
9991 next ( err ) ;
10092 }
10193} ) ;
94+
95+ const validateSenderDestination = ( sender : string , senderDestination : string ) => {
96+ if ( sender === peerID ) {
97+ if ( ! config . destinations ?. includes ( senderDestination ) ) {
98+ throw new RequestError ( `Unknown sender destination expected=${ config . destinations ?. join ( '|' ) ?? 'none' } recieved=${ senderDestination } ` , 404 ) ;
99+ }
100+ } else {
101+ const peer = config . peers . find ( peer => peer . id === sender ) ;
102+ if ( peer === undefined ) {
103+ throw new RequestError ( `Unknown sender ${ sender } ` , 404 ) ;
104+ }
105+ if ( ! peer . destinations ?. includes ( senderDestination ) ) {
106+ throw new RequestError ( `Unknown sender destination expected=${ peer . destinations ?. join ( '|' ) ?? 'none' } recieved=${ senderDestination } ` , 404 ) ;
107+ }
108+ }
109+ } ;
0 commit comments