From b52cc0c590c90b8ea74247be68db2a14a5cd54ab Mon Sep 17 00:00:00 2001 From: Abdullah Atta Date: Mon, 20 Feb 2023 15:23:41 +0500 Subject: [PATCH] web: do not allow non-string ETag header in attachments upload --- apps/web/src/interfaces/fs.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apps/web/src/interfaces/fs.js b/apps/web/src/interfaces/fs.js index e2875b04c..b1fca7ea7 100644 --- a/apps/web/src/interfaces/fs.js +++ b/apps/web/src/interfaces/fs.js @@ -259,8 +259,10 @@ async function uploadFile(filename, requestOptions) { throw new S3Error(`Failed to upload part at offset ${i}`, e); }); - if (!response.headers.etag) - throw new Error(`Failed to upload part at offset ${i}: no etag found.`); + if (!response.headers.etag || typeof response.headers.etag !== "string") + throw new Error( + `Failed to upload part at offset ${i}: invalid etag. ETag: ${response.headers.etag}` + ); uploadedBytes += blob.size; uploadedChunks.push({