Merge pull request #3026 from Northeastern-Electric-Racing/#2908-Fina…

…nce-File-Name-Limit #2908 Added limits to the reinbursement receipt's file name
Northeastern-Electric-Racing · Dec 21, 2024 · af04987 · af04987
2 parents c87c24a + 3e4025d
commit af04987
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 4 deletions.
diff --git a/src/backend/src/utils/google-integration.utils.ts b/src/backend/src/utils/google-integration.utils.ts
@@ -88,6 +88,11 @@ export const uploadFile = async (fileObject: Express.Multer.File) => {
   const bufferStream = new stream.PassThrough();
   bufferStream.end(fileObject.buffer);
 
+  if (fileObject.filename.length > 20) throw new HttpException(400, 'File name can only be at most 20 characters long');
+  //The regex /^[\w.]+$/ limits the file name to the set of alphanumeric characters (\w) and dots (for file type)
+  if (!/^[\w.]+$/.test(fileObject.filename))
+    throw new HttpException(400, 'File name should only contain letters and numbers');
+
   oauth2Client.setCredentials({
     refresh_token: DRIVE_REFRESH_TOKEN
   });

diff --git a/src/frontend/src/pages/FinancePage/ReimbursementRequestForm/ReimbursementFormView.tsx b/src/frontend/src/pages/FinancePage/ReimbursementRequestForm/ReimbursementFormView.tsx
@@ -367,15 +367,22 @@ const ReimbursementRequestFormView: React.FC<ReimbursementRequestFormViewProps>
                   onChange={(e) => {
                     if (e.target.files) {
                       [...e.target.files].forEach((file) => {
-                        if (file.size < 1000000) {
+                        /* The regex /^[\w.]+$/ limits the file name to the set of alphanumeric characters (\w) and dots (for file type) */
+                        if (file.size >= 1000000) {
+                          toast.error(`Error uploading ${file.name}; file must be less than 1 MB`, 5000);
+                          document.getElementById('receipt-image')!.innerHTML = '';
+                        } else if (file.name.length > 20) {
+                          toast.error(`Error uploading ${file.name}; file name must be less than 20 characters`, 5000);
+                          document.getElementById('receipt-image')!.innerHTML = '';
+                        } else if (!/^[\w.]+$/.test(file.name)) {
+                          toast.error(`Error uploading ${file.name}; file name must only contain letter and numbers`, 5000);
+                          document.getElementById('receipt-image')!.innerHTML = '';
+                        } else {
                           receiptPrepend({
                             file,
                             name: file.name,
                             googleFileId: ''
                           });
-                        } else {
-                          toast.error(`Error uploading ${file.name}; file must be less than 1 MB`, 5000);
-                          document.getElementById('receipt-image')!.innerHTML = '';
                         }
                       });
                     }