Project

General

Profile

Bug #18744

API - PUT method for applying errata to hosts does not validate values

Added by Ondřej Pražák over 2 years ago. Updated about 1 year ago.

Status:
New
Priority:
Normal
Category:
-
Target version:
Difficulty:
Triaged:
Yes
Bugzilla link:
Pull request:
Team Backlog:
Fixed in Releases:
Found in Releases:

Description

There seems to be no input validation for parameters provided to /api/hosts/<host>/errata/apply (specifically errata_ids parameter):


$ curl -k -u admin:changeme -X PUT -H 'Content-Type: application/json' -d '{"errata_ids": 1}' https://my-server.com/api/v2/hosts/12977/errata/apply
{"displayMessage":"ERROR:  operator does not exist: character varying = integer\nLINE 1: ...ROM \"katello_errata\"  WHERE \"katello_errata\".\"errata_id\" = 1\n                                                                    ^\nHINT:  No operator matches the given name and argument type(s). You might need to add explicit type casts.\n","errors":["ERROR:  operator does not exist: character varying = integer\nLINE 1: ...ROM \"katello_errata\"  WHERE \"katello_errata\".\"errata_id\" = 1\n                                                                    ^\nHINT:  No operator matches the given name and argument type(s). You might need to add explicit type casts.\n"]}

How reproducible:
always

Steps to Reproduce:
1. get some hosts registered
2. send out the request as stated above

Actual results:
no input validation happens on the parameters, so the code uses any input and crashes with it (wrong or null type, etc.)

Expected results:
validation takes place and raise proper exception if the input is invalid, user receives properly formatted error message in the JSON response.

History

#1 Updated by Kavita Gaikwad over 2 years ago

  • Subject changed from API - PUT method for applying errata to hosts does not validate values to API - PUT method for applying errata to hosts does not validate values
  • Assignee set to Kavita Gaikwad

#2 Updated by Eric Helms over 2 years ago

  • Legacy Backlogs Release (now unused) set to 114

#3 Updated by Marek Hulán about 2 years ago

this looks similar to http://projects.theforeman.org/issues/13670, it seems that wrapping errata id in quotes might help, anyway I can't reproduce the linked issue anymore so probably work of rechecking this one too

Also available in: Atom PDF