Added backend handling of importing pre-cracked hashes by upload file and url

Author: Eric-Wasson

src/inc/apiv2/helper/importCrackedHashes.routes.php

@@ -26,6 +26,7 @@ public function getRequiredPermissions(string $method): array {
   public function getFormFields(): array {
     return [
       Hashlist::HASHLIST_ID => ["type" => "int"],
+      "sourceType" => ['type' => 'str'],
       "sourceData" => ['type' => 'str'],
       "separator" => ['type' => 'str'],
       "overwrite" => ['type' => 'int'],
@@ -47,13 +48,38 @@ public static function getResponse(): array {
   /**
    * Endpoint to import cracked hashes into a hashlist.
    * @throws HTException
+   * @throws HttpError
    */
   public function actionPost($data): object|array|null {
     $hashlist = self::getHashlist($data[Hashlist::HASHLIST_ID]);
 
-    $importData = base64_decode($data["sourceData"]);
+    // Cast to processZap compatible upload format
+    $dummyPost = [];
+    switch ($data["sourceType"]) {
+      case "paste":
+        $dummyPost["hashfield"] = base64_decode($data["sourceData"]);
+        break;
+      case "import":
+        $dummyPost["importfile"] = $data["sourceData"];
+        break;
+      case "url":
+        $dummyPost["url"] = $data["sourceData"];
+        break;
+      default:
+        // TODO: Choice validation are model based checks
+        throw new HttpErrorException("sourceType value '" . $data["sourceType"] . "' is not supported (choices paste, import, url");
+    }
+
+    if ($data["sourceType"] == "paste") {
+      if (strlen($data["sourceData"]) == 0) {
+        throw new HttpError("sourceType=paste, requires sourceData to be non-empty");
+      }
+      else if ($dummyPost["hashfield"] === false) {
+        throw new HttpError("sourceData not valid base64 encoding");
+      }
+    }
 
-    $result = HashlistUtils::processZap($hashlist->getId(), $data["separator"], "paste", ["hashfield" => $importData], [], $this->getCurrentUser(), (isset($data["overwrite"]) && intval($data["overwrite"]) == 1) ? true : false);
+    $result = HashlistUtils::processZap($hashlist->getId(), $data["separator"], $data["sourceType"], $dummyPost, [], $this->getCurrentUser(), (isset($data["overwrite"]) && intval($data["overwrite"]) == 1) ? true : false);
 
     return [
       "totalLines" => $result[0],

src/inc/apiv2/model/hashlists.routes.php

@@ -102,6 +102,7 @@ public function getFormFields(): array {
 
   /**
    * @throws HttpErrorException
+   * @throws HttpError
    * @throws HTException
    */
   protected function createObject(array $data): int {
@@ -122,11 +123,12 @@ protected function createObject(array $data): int {
         throw new HttpErrorException("sourceType value '" . $data["sourceType"] . "' is not supported (choices paste, import, url");
     }
 
-    // TODO: validate input is valid base64 encoded
     if ($data["sourceType"] == "paste") {
       if (strlen($data["sourceData"]) == 0) {
-        // TODO: Should be 400 instead
-        throw new HttpErrorException("sourceType=paste, requires sourceData to be non-empty");
+        throw new HttpError("sourceType=paste, requires sourceData to be non-empty");
+      }
+      else if ($dummyPost["hashfield"] === false) {
+        throw new HttpError("sourceData not valid base64 encoding");
       }
     }