Git-Mirrors/mat2-web
1
0
Fork 0
mirror of https://0xacab.org/jvoisin/mat2-web.git synced 2025-02-24 00:59:59 -05:00
Code Issues Packages Projects Releases Wiki Activity

added baspath used for fuzzing and use blueprints for api routes

Browse Source
This commit is contained in:
Jan Friedli 2020-07-13 09:52:34 +02:00
parent e258b3084d
commit b39d16eaf8
No known key found for this signature in database
GPG Key ID: F945FA2FCA30549D
2 changed files with 35 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
main.py
View File

@ -17,6 +17,7 @@ def create_app(test_config=None):
app.config['SWAGGER'] = { app.config['SWAGGER'] = {
'title': 'Mat2 Web API', 'title': 'Mat2 Web API',
'version': '1.0.0', 'version': '1.0.0',
'basePath': '/api'
} }
# optionally load settings from config.py # optionally load settings from config.py
app.config.from_object('config') app.config.from_object('config')
@ -32,25 +33,9 @@ def create_app(test_config=None):
app.register_blueprint(frontend.routes) app.register_blueprint(frontend.routes)
# Restful API hookup # Restful API hookup
api = Api(app) app.register_blueprint(rest_api.api_bp)
Swagger(app) Swagger(app)
CORS(app, resources={r"/api/*": {"origins": utils.get_allow_origin_header_value()}}) CORS(app, resources={r"/api/*": {"origins": utils.get_allow_origin_header_value()}})
api.add_resource(
rest_api.APIUpload,
'/api/upload',
resource_class_kwargs={'upload_folder': app.config['UPLOAD_FOLDER']}
)
api.add_resource(
rest_api.APIDownload,
'/api/download/<string:key>/<string:secret>/<string:filename>',
resource_class_kwargs={'upload_folder': app.config['UPLOAD_FOLDER']}
)
api.add_resource(
rest_api.APIBulkDownloadCreator,
'/api/download/bulk',
resource_class_kwargs={'upload_folder': app.config['UPLOAD_FOLDER']}
)
api.add_resource(rest_api.APISupportedExtensions, '/api/extension')
return app return app

59
matweb/rest_api.py
View File

@ -5,8 +5,8 @@ import binascii
import zipfile import zipfile
from uuid import uuid4 from uuid import uuid4
from flask import after_this_request, send_from_directory from flask import after_this_request, send_from_directory, Blueprint, current_app
from flask_restful import Resource, reqparse, abort, request, url_for from flask_restful import Resource, reqparse, abort, request, url_for, Api
from cerberus import Validator from cerberus import Validator
from werkzeug.datastructures import FileStorage from werkzeug.datastructures import FileStorage
from flasgger import swag_from from flasgger import swag_from
@ -15,14 +15,14 @@ from flasgger import swag_from
from matweb import file_removal_scheduler, utils from matweb import file_removal_scheduler, utils
class APIUpload(Resource): api_bp = Blueprint('api_bp', __name__, url_prefix='/api/')
api = Api(api_bp)
def __init__(self, **kwargs):
self.upload_folder = kwargs['upload_folder']
class APIUpload(Resource):
@swag_from('./oas/upload.yml') @swag_from('./oas/upload.yml')
def post(self): def post(self):
utils.check_upload_folder(self.upload_folder) utils.check_upload_folder(current_app.config['UPLOAD_FOLDER'])
req_parser = reqparse.RequestParser() req_parser = reqparse.RequestParser()
req_parser.add_argument('file_name', type=str, required=True, help='Post parameter is not specified: file_name') req_parser.add_argument('file_name', type=str, required=True, help='Post parameter is not specified: file_name')
req_parser.add_argument('file', type=str, required=True, help='Post parameter is not specified: file') req_parser.add_argument('file', type=str, required=True, help='Post parameter is not specified: file')
@ -35,7 +35,7 @@ class APIUpload(Resource):
file = FileStorage(stream=io.BytesIO(file_data), filename=args['file_name']) file = FileStorage(stream=io.BytesIO(file_data), filename=args['file_name'])
try: try:
filename, filepath = utils.save_file(file, self.upload_folder) filename, filepath = utils.save_file(file, current_app.config['UPLOAD_FOLDER'])
except ValueError: except ValueError:
abort(400, message='Invalid Filename') abort(400, message='Invalid Filename')
@ -48,7 +48,7 @@ class APIUpload(Resource):
if not parser.remove_all(): if not parser.remove_all():
abort(500, message='Unable to clean %s' % mime) abort(500, message='Unable to clean %s' % mime)
key, secret, meta_after, output_filename = utils.cleanup(parser, filepath, self.upload_folder) key, secret, meta_after, output_filename = utils.cleanup(parser, filepath, current_app.config['UPLOAD_FOLDER'])
return utils.return_file_created_response( return utils.return_file_created_response(
utils.get_file_removal_max_age_sec(), utils.get_file_removal_max_age_sec(),
output_filename, output_filename,
@ -58,7 +58,7 @@ class APIUpload(Resource):
meta, meta,
meta_after, meta_after,
url_for( url_for(
'apidownload', 'api_bp.apidownload',
key=key, key=key,
secret=secret, secret=secret,
filename=output_filename, filename=output_filename,
@ -68,16 +68,12 @@ class APIUpload(Resource):
class APIDownload(Resource): class APIDownload(Resource):
def __init__(self, **kwargs):
self.upload_folder = kwargs['upload_folder']
@swag_from('./oas/download.yml') @swag_from('./oas/download.yml')
def get(self, key: str, secret: str, filename: str): def get(self, key: str, secret: str, filename: str):
complete_path, filepath = utils.is_valid_api_download_file(filename, key, secret, self.upload_folder) complete_path, filepath = utils.is_valid_api_download_file(filename, key, secret, current_app.config['UPLOAD_FOLDER'])
# Make sure the file is NOT deleted on HEAD requests # Make sure the file is NOT deleted on HEAD requests
if request.method == 'GET': if request.method == 'GET':
file_removal_scheduler.run_file_removal_job(self.upload_folder) file_removal_scheduler.run_file_removal_job(current_app.config['UPLOAD_FOLDER'])
@after_this_request @after_this_request
def remove_file(response): def remove_file(response):
@ -85,14 +81,10 @@ class APIDownload(Resource):
os.remove(complete_path) os.remove(complete_path)
return response return response
return send_from_directory(self.upload_folder, filepath, as_attachment=True) return send_from_directory(current_app.config['UPLOAD_FOLDER'], filepath, as_attachment=True)
class APIBulkDownloadCreator(Resource): class APIBulkDownloadCreator(Resource):
def __init__(self, **kwargs):
self.upload_folder = kwargs['upload_folder']
schema = { schema = {
'download_list': { 'download_list': {
'type': 'list', 'type': 'list',
@ -112,13 +104,13 @@ class APIBulkDownloadCreator(Resource):
@swag_from('./oas/bulk.yml') @swag_from('./oas/bulk.yml')
def post(self): def post(self):
utils.check_upload_folder(self.upload_folder) utils.check_upload_folder(current_app.config['UPLOAD_FOLDER'])
data = request.json data = request.json
if not self.v.validate(data): if not self.v.validate(data):
abort(400, message=self.v.errors) abort(400, message=self.v.errors)
# prevent the zip file from being overwritten # prevent the zip file from being overwritten
zip_filename = 'files.' + str(uuid4()) + '.zip' zip_filename = 'files.' + str(uuid4()) + '.zip'
zip_path = os.path.join(self.upload_folder, zip_filename) zip_path = os.path.join(current_app.config['UPLOAD_FOLDER'], zip_filename)
cleaned_files_zip = zipfile.ZipFile(zip_path, 'w') cleaned_files_zip = zipfile.ZipFile(zip_path, 'w')
with cleaned_files_zip: with cleaned_files_zip:
for file_candidate in data['download_list']: for file_candidate in data['download_list']:
@ -126,7 +118,7 @@ class APIBulkDownloadCreator(Resource):
file_candidate['file_name'], file_candidate['file_name'],
file_candidate['key'], file_candidate['key'],
file_candidate['secret'], file_candidate['secret'],
self.upload_folder current_app.config['UPLOAD_FOLDER']
) )
try: try:
cleaned_files_zip.write(complete_path) cleaned_files_zip.write(complete_path)
@ -142,7 +134,7 @@ class APIBulkDownloadCreator(Resource):
parser, mime = utils.get_file_parser(zip_path) parser, mime = utils.get_file_parser(zip_path)
if not parser.remove_all(): if not parser.remove_all():
abort(500, message='Unable to clean %s' % mime) abort(500, message='Unable to clean %s' % mime)
key, secret, meta_after, output_filename = utils.cleanup(parser, zip_path, self.upload_folder) key, secret, meta_after, output_filename = utils.cleanup(parser, zip_path, current_app.config['UPLOAD_FOLDER'])
return { return {
'inactive_after_sec': utils.get_file_removal_max_age_sec(), 'inactive_after_sec': utils.get_file_removal_max_age_sec(),
'output_filename': output_filename, 'output_filename': output_filename,
@ -151,7 +143,7 @@ class APIBulkDownloadCreator(Resource):
'secret': secret, 'secret': secret,
'meta_after': meta_after, 'meta_after': meta_after,
'download_link': url_for( 'download_link': url_for(
'apidownload', 'api_bp.apidownload',
key=key, key=key,
secret=secret, secret=secret,
filename=output_filename, filename=output_filename,
@ -164,3 +156,18 @@ class APISupportedExtensions(Resource):
@swag_from('./oas/extension.yml') @swag_from('./oas/extension.yml')
def get(self): def get(self):
return utils.get_supported_extensions() return utils.get_supported_extensions()
api.add_resource(
APIUpload,
'/upload'
)
api.add_resource(
APIDownload,
'/download/<string:key>/<string:secret>/<string:filename>'
)
api.add_resource(
APIBulkDownloadCreator,
'/download/bulk'
)
api.add_resource(APISupportedExtensions, '/extension')