[Maps] fix fonts api (#107768)

* [Maps] fix fonts api

* update expect statement name

* eslint

* add test case for './../'

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

x-pack/plugins/maps/server/routes.js

@@ -525,25 +525,23 @@ export async function initRoutes(core, getLicenseId, emsSettings, kbnVersion, lo
       },
     },
     (context, request, response) => {
-      return new Promise((resolve, reject) => {
+      const range = path.normalize(request.params.range);
-        const santizedRange = path.normalize(request.params.range);
+      return range.startsWith('..')
-        const fontPath = path.join(__dirname, 'fonts', 'open_sans', `${santizedRange}.pbf`);
+        ? response.notFound()
-        fs.readFile(fontPath, (error, data) => {
+        : new Promise((resolve) => {
-          if (error) {
+            const fontPath = path.join(__dirname, 'fonts', 'open_sans', `${range}.pbf`);
-            reject(
+            fs.readFile(fontPath, (error, data) => {
-              response.custom({
+              if (error) {
-                statusCode: 404,
+                resolve(response.notFound());
-              })
+              } else {
-            );
+                resolve(
-          } else {
+                  response.ok({
-            resolve(
+                    body: data,
-              response.ok({
+                  })
-                body: data,
+                );
-              })
+              }
-            );
+            });
-          }
+          });
-        });
-      });
     }
   );
 

x-pack/test/api_integration/apis/maps/fonts_api.js

@@ -18,5 +18,19 @@ export default function ({ getService }) {
 
       expect(resp.body.length).to.be(74696);
     });
+
+    it('should return 404 when file not found', async () => {
+      await supertest
+        .get(`/api/maps/fonts/Open%20Sans%20Regular,Arial%20Unicode%20MS%20Regular/noGonaFindMe`)
+        .expect(404);
+    });
+
+    it('should return 404 when file is not in font folder (../)', async () => {
+      await supertest.get(`/api/maps/fonts/open_sans/..%2fopen_sans%2f0-255`).expect(404);
+    });
+
+    it('should return 404 when file is not in font folder (./../)', async () => {
+      await supertest.get(`/api/maps/fonts/open_sans/.%2f..%2fopen_sans%2f0-255`).expect(404);
+    });
   });
 }