[Maps] fix fonts api (#107768)

* [Maps] fix fonts api

* update expect statement name

* eslint

* add test case for './../'

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

x-pack/plugins/maps/server/routes.js

@@ -525,16 +525,14 @@ export async function initRoutes(core, getLicenseId, emsSettings, kbnVersion, lo
       },
     },
     (context, request, response) => {
-      return new Promise((resolve, reject) => {
+      const range = path.normalize(request.params.range);
-        const santizedRange = path.normalize(request.params.range);
+      return range.startsWith('..')
-        const fontPath = path.join(__dirname, 'fonts', 'open_sans', `${santizedRange}.pbf`);
+        ? response.notFound()
+        : new Promise((resolve) => {
+            const fontPath = path.join(__dirname, 'fonts', 'open_sans', `${range}.pbf`);
             fs.readFile(fontPath, (error, data) => {
               if (error) {
-            reject(
+                resolve(response.notFound());
-              response.custom({
-                statusCode: 404,
-              })
-            );
               } else {
                 resolve(
                   response.ok({

x-pack/test/api_integration/apis/maps/fonts_api.js

@@ -18,5 +18,19 @@ export default function ({ getService }) {
 
       expect(resp.body.length).to.be(74696);
     });
+
+    it('should return 404 when file not found', async () => {
+      await supertest
+        .get(`/api/maps/fonts/Open%20Sans%20Regular,Arial%20Unicode%20MS%20Regular/noGonaFindMe`)
+        .expect(404);
+    });
+
+    it('should return 404 when file is not in font folder (../)', async () => {
+      await supertest.get(`/api/maps/fonts/open_sans/..%2fopen_sans%2f0-255`).expect(404);
+    });
+
+    it('should return 404 when file is not in font folder (./../)', async () => {
+      await supertest.get(`/api/maps/fonts/open_sans/.%2f..%2fopen_sans%2f0-255`).expect(404);
+    });
   });
 }