fix

Author: mtrezza

spec/ParseFile.spec.js

@@ -654,6 +654,35 @@ describe('Parse.File testing', () => {
     });
   });
 
+  describe('getting files', () => {
+    it('can get invalid file', async () => {
+      const getFile = async () => {
+        try {
+          await request({ url: 'http://localhost:8378/1/files/invalid-id/invalid-file.txt' });
+        } catch (e) {
+          throw new Parse.Error(e.data.code, e.data.error);
+        }
+      };
+      await expectAsync(getFile()).toBeRejectedWith(
+        new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Invalid appId.')
+      );
+      const { status, data } = await request({ url: 'http://localhost:8378/1/health' });
+      expect(status).toEqual(200);
+      expect(data).toEqual({ status: 'ok' });
+    });
+
+    it('can get invalid metadata', async () => {
+      const metadata = await request({
+        url: `http://localhost:8378/1/files/invalid-id/metadata/invalid-file.txt`,
+      });
+      expect(metadata.status).toBe(200);
+      expect(metadata.data).toEqual({});
+      const { status, data } = await request({ url: 'http://localhost:8378/1/health' });
+      expect(status).toEqual(200);
+      expect(data).toEqual({ status: 'ok' });
+    });
+  });
+
   xdescribe('Gridstore Range tests', () => {
     it('supports range requests', done => {
       const headers = {

src/Routers/FilesRouter.js

@@ -66,6 +66,12 @@ export class FilesRouter {
 
   getHandler(req, res) {
     const config = Config.get(req.params.appId);
+    if (!config) {
+      res.status(403);
+      const err = new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'Invalid application ID.');
+      res.json({ code: err.code, error: err.message });
+      return;
+    }
     const filesController = config.filesController;
     const filename = req.params.filename;
     const contentType = mime.getType(filename);
@@ -250,10 +256,10 @@ export class FilesRouter {
   }
 
   async metadataHandler(req, res) {
-    const config = Config.get(req.params.appId);
-    const { filesController } = config;
-    const { filename } = req.params;
     try {
+      const config = Config.get(req.params.appId);
+      const { filesController } = config;
+      const { filename } = req.params;
       const data = await filesController.getMetadata(filename);
       res.status(200);
       res.json(data);