External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-13 19:10:07 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5576 from ryanpetrello/fix-4756

Browse Source 
prohibit API payloads that represent something other than a JSON object
This commit is contained in:
Ryan Petrello 2017-02-28 14:04:32 -05:00 committed by GitHub
commit 7b34b36e5e
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
awx/api/parsers.py
View File

@ -26,6 +26,9 @@ class JSONParser(parsers.JSONParser):
try:
data = stream.read().decode(encoding)
return json.loads(data, object_pairs_hook=OrderedDict)
obj = json.loads(data, object_pairs_hook=OrderedDict)
if not isinstance(obj, dict):
raise ParseError(_('JSON parse error - not a JSON object'))
return obj
except ValueError as exc:
raise ParseError(_('JSON parse error - %s') % six.text_type(exc))

17
awx/main/tests/functional/api/test_job_template.py
View File

@ -94,6 +94,23 @@ def test_edit_playbook(patch, job_template_factory, alice):
}, alice, expect=403)
@pytest.mark.django_db
@pytest.mark.parametrize('json_body',
["abc", True, False, "{\"name\": \"test\"}", 100, .5])
def test_invalid_json_body(patch, job_template_factory, alice, json_body):
objs = job_template_factory('jt', organization='org1')
objs.job_template.admin_role.members.add(alice)
resp = patch(
reverse('api:job_template_detail', args=(objs.job_template.id,)),
json_body,
alice,
expect=400
)
assert resp.data['detail'] == (
u'JSON parse error - not a JSON object'
)
@pytest.mark.django_db
def test_edit_nonsenstive(patch, job_template_factory, alice):
objs = job_template_factory('jt', organization='org1', project='prj', inventory='inv', credential='cred')