Skip to content

Add defensive checks against URI parameters in the public API #4788

@sentry

Description

@sentry

Observed behavior

Requests to the public APIs, such as /api/public/v2/contentnode_tree/8f0a5b9d89795/, that have an invalid UUID cause a 500 error.

Sentry Issue: STUDIO-HH7

ValueError: badly formed hexadecimal UUID string
(23 additional frame(s) were not displayed)
...
  File "kolibri_public/views.py", line 65, in wrapper_func
    response = some_func(*args, **kwargs)
  File "kolibri_public/views.py", line 700, in retrieve
    queryset = self.get_tree_queryset(request, pk)
  File "kolibri_public/views.py", line 646, in get_tree_queryset
    if pk and self.filter_queryset(self.get_queryset()).filter(id=pk).exists()
  File "kolibri_content/fields.py", line 159, in get_db_prep_value
    value = uuid.UUID(value)

Expected behavior

This error is caused by 'bad input', which we still don't want to accept. Although, since the error causes a 500 response, it would be better for us to validate any request input matches what we expect, which in this case the request parameter looks like a UUID, and return a 'Bad Request' response instead. We should do this for all the public APIs.

Metadata

Metadata

Assignees

Type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions