Close data leaks: remove anonymous user creation, hide private playlists, validate uploads and clamp gateway ranges

2026-09-24 05:00:21 +02:00
parent c8fe28b07b
commit c8e9c7790e
34 changed files with 374 additions and 553 deletions
@@ -1,20 +1,20 @@
 using FluentValidation;
 using Musify.Api.DataTransferObjects.PlayLists;
+using Musify.Application.Configuration;

 namespace Musify.Api.Validators.PlayLists;

 public sealed class RequestPlayListPictureUploadRequestValidator : AbstractValidator<RequestPlayListPictureUploadRequest>
 {
-    public RequestPlayListPictureUploadRequestValidator()
+    public RequestPlayListPictureUploadRequestValidator(UploadIntentConfiguration uploadConfiguration)
    {
        RuleFor(x => x.FileType)
-            .NotEmpty();
+            .MustBeFileType(Uploads.PictureFileTypes);

        RuleFor(x => x.ContentType)
-            .NotEmpty();
+            .MustBeContentType(Uploads.PictureContentTypes);

        RuleFor(x => x.ExpectedSizeBytes)
-            .GreaterThan(0)
-            .When(x => x.ExpectedSizeBytes.HasValue);
+            .MustBeValidUploadSize(uploadConfiguration.MaxUploadBytes);
    }
 }