openstack/nova
Code Issues Proposed changes

Merge "Invalid query parameter could lead to HTTP 500"

Browse Source
This commit is contained in:
Zuul 2018-02-13 20:02:56 +00:00 committed by Gerrit Code Review
commit dbdb6213cb
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
nova/api/validation/__init__.py
View File

@ -21,6 +21,8 @@ import re
from nova.api.openstack import api_version_request as api_version
from nova.api.validation import validators
from nova import exception
from nova.i18n import _
def _schema_validation_helper(schema, target, min_version, max_version,
@ -167,8 +169,17 @@ def query_schema(query_params_schema, min_version=None,
else:
req = args[1]
# NOTE(Kevin_Zheng): The webob package throws UnicodeError when
# param cannot be decoded. Catch this and raise HTTP 400.
try:
query_dict = req.GET.dict_of_lists()
except UnicodeDecodeError:
msg = _('Query string is not UTF-8 encoded')
raise exception.ValidationError(msg)
if _schema_validation_helper(query_params_schema,
req.GET.dict_of_lists(),
query_dict,
min_version, max_version,
args, kwargs, is_body=False):
# NOTE(alex_xu): The additional query parameters were stripped

7
nova/tests/unit/test_api_validation.py
View File

@ -305,6 +305,13 @@ class QueryParamsSchemaTestCase(test.NoDBTestCase):
req.api_version_request = api_version.APIVersionRequest("2.3")
self.assertRaises(exception.ValidationError, self.controller.get, req)
def test_validate_request_unicode_decode_failure(self):
req = fakes.HTTPRequest.blank("/tests?foo=%88")
req.api_version_request = api_version.APIVersionRequest("2.1")
ex = self.assertRaises(
exception.ValidationError, self.controller.get, req)
self.assertIn("Query string is not UTF-8 encoded", six.text_type(ex))
def test_strip_out_additional_properties(self):
req = fakes.HTTPRequest.blank(
"/tests?foos=abc&foo=%s&bar=123&-bar=456" % fakes.FAKE_UUID)