Checking int fields for params and limiting retrieval amount

api/api_helpers.py

@@ -12,6 +12,7 @@
 from fastapi.responses import ORJSONResponse
 from fastapi import Depends, Request, HTTPException
 from fastapi.security import APIKeyHeader
+from fastapi.exceptions import RequestValidationError
 import numpy as np
 import scipy.stats
 from pydantic import BaseModel
@@ -192,6 +193,8 @@ def get_timeline_query(user, uri, filename, machine_id, branch, metrics, phase,
     if branch is None or branch.strip() == '':
         branch = 'main'
 
+    check_int_field_api(machine_id, 'machine_id', 1024) # can cause exception
+
     params = [user.is_super_user(), user.visible_users(), uri, filename, branch, machine_id, f"%{phase}"]
 
     metrics_condition = ''
@@ -776,3 +779,15 @@ def get_connecting_ip(request):
         return connecting_ip.split(",")[0]
 
     return request.client.host
+
+def check_int_field_api(field, name, max_value):
+    if not isinstance(field, int):
+        raise RequestValidationError(f'{name} must be integer')
+
+    if field <= 0:
+        raise RequestValidationError(f'{name} must be > 0')
+
+    if field > max_value:
+        raise RequestValidationError(f'{name} must be <= {max_value}')
+
+    return True

api/main.py

@@ -27,7 +27,7 @@
                          html_escape_multi, get_phase_stats, get_phase_stats_object,
                          is_valid_uuid, convert_value, get_timeline_query,
                          get_run_info, get_machine_list, get_artifact, store_artifact,
-                         authenticate)
+                         authenticate, check_int_field_api)
 
 from lib.global_config import GlobalConfig
 from lib.db import DB
@@ -179,7 +179,7 @@ async def get_jobs(
     machine_id_condition = ''
     state_condition = ''
 
-    if machine_id is not None:
+    if machine_id and check_int_field_api(machine_id, 'machine_id', 1024):
         machine_id_condition = 'AND j.machine_id = %s'
         params.append(machine_id)
 
@@ -276,7 +276,7 @@ async def get_repositories(uri: str | None = None, branch: str | None = None, ma
         query = f"{query} AND r.filename LIKE %s  \n"
         params.append(f"%{filename}%")
 
-    if machine_id:
+    if machine_id and check_int_field_api(machine_id, 'machine_id', 1024):
         query = f"{query} AND m.id = %s \n"
         params.append(machine_id)
 
@@ -302,7 +302,7 @@ async def get_repositories(uri: str | None = None, branch: str | None = None, ma
 
 # A route to return all of the available entries in our catalog.
 @app.get('/v1/runs')
-async def get_runs(uri: str | None = None, branch: str | None = None, machine_id: int | None = None, machine: str | None = None, filename: str | None = None, limit: int | None = None, uri_mode = 'none', user: User = Depends(authenticate)):
+async def get_runs(uri: str | None = None, branch: str | None = None, machine_id: int | None = None, machine: str | None = None, filename: str | None = None, limit: int = 5, uri_mode = 'none', user: User = Depends(authenticate)):
 
     query = '''
             SELECT r.id, r.name, r.uri, r.branch, r.created_at, r.invalid_run, r.filename, m.description, r.commit_hash, r.end_measurement, r.failed, r.machine_id
@@ -329,7 +329,7 @@ async def get_runs(uri: str | None = None, branch: str | None = None, machine_id
         query = f"{query} AND r.filename LIKE %s  \n"
         params.append(f"%{filename}%")
 
-    if machine_id:
+    if machine_id and check_int_field_api(machine_id, 'machine_id', 1024):
         query = f"{query} AND m.id = %s \n"
         params.append(machine_id)
 
@@ -339,9 +339,9 @@ async def get_runs(uri: str | None = None, branch: str | None = None, machine_id
 
     query = f"{query} ORDER BY r.created_at DESC"
 
-    if limit:
-        query = f"{query} LIMIT %s"
-        params.append(limit)
+    check_int_field_api(limit, 'limit', 50)
+    query = f"{query} LIMIT %s"
+    params.append(limit)
 
 
     data = DB().fetch_all(query, params=params)