diff --git a/swift3/controllers/multi_upload.py b/swift3/controllers/multi_upload.py index 684cd3ea..1c355e6b 100644 --- a/swift3/controllers/multi_upload.py +++ b/swift3/controllers/multi_upload.py @@ -94,10 +94,12 @@ class PartController(Controller): 'Unexpected query string parameter') try: - # TODO: check the range of partNumber part_number = int(req.params['partNumber']) + if part_number < 1 or DEFAULT_MAX_PARTS < part_number: + raise Exception() except Exception: - err_msg = 'Part number must be an integer' + err_msg = 'Part number must be an integer between 1 and %d,' \ + ' inclusive' % DEFAULT_MAX_PARTS raise InvalidArgument('partNumber', req.params['partNumber'], err_msg) diff --git a/swift3/test/unit/test_multi_upload.py b/swift3/test/unit/test_multi_upload.py index 32fd805a..a046ff8c 100644 --- a/swift3/test/unit/test_multi_upload.py +++ b/swift3/test/unit/test_multi_upload.py @@ -391,6 +391,27 @@ class TestSwift3MultiUpload(Swift3TestCase): status, headers, body = self.call_swift3(req) self.assertEquals(self._get_error_code(body), 'InvalidArgument') + req = Request.blank('/bucket/object?partNumber=invalid&uploadId=X', + environ={'REQUEST_METHOD': 'PUT'}, + headers={'Authorization': 'AWS test:tester:hmac'}, + body='part object') + status, headers, body = self.call_swift3(req) + self.assertEquals(self._get_error_code(body), 'InvalidArgument') + + req = Request.blank('/bucket/object?partNumber=0&uploadId=X', + environ={'REQUEST_METHOD': 'PUT'}, + headers={'Authorization': 'AWS test:tester:hmac'}, + body='part object') + status, headers, body = self.call_swift3(req) + self.assertEquals(self._get_error_code(body), 'InvalidArgument') + + req = Request.blank('/bucket/object?partNumber=1001&uploadId=X', + environ={'REQUEST_METHOD': 'PUT'}, + headers={'Authorization': 'AWS test:tester:hmac'}, + body='part object') + status, headers, body = self.call_swift3(req) + self.assertEquals(self._get_error_code(body), 'InvalidArgument') + @s3acl def test_object_upload_part(self): req = Request.blank('/bucket/object?partNumber=1&uploadId=X',