From 8733428aedc0db57e28371c7b9decd662415bcfb Mon Sep 17 00:00:00 2001 From: Dominik Schmidt Date: Sun, 6 Sep 2026 23:52:27 +0200 Subject: [PATCH] fix(graph): keep CreateUploadSession strict below the public drive The relaxed item addressing is a read feature; writing through it is untested and not part of this surface. --- services/graph/pkg/service/v0/driveitems.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/services/graph/pkg/service/v0/driveitems.go b/services/graph/pkg/service/v0/driveitems.go index 4c58be5ffd..6453c79fb5 100644 --- a/services/graph/pkg/service/v0/driveitems.go +++ b/services/graph/pkg/service/v0/driveitems.go @@ -162,7 +162,9 @@ func (g Graph) CreateUploadSession(w http.ResponseWriter, r *http.Request) { errorcode.RenderError(w, r, err) return } - if !driveItemInDrive(&driveID, &driveItemID) { + // strict on purpose: uploading through the public drive addressing is not + // part of the listing surface and stays untested for now + if driveID.GetStorageId() != driveItemID.GetStorageId() || driveID.GetSpaceId() != driveItemID.GetSpaceId() { errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "Item does not exist") return }