Repository navigation
Add defensive checks against URI parameters in the public API #4788
Description
Observed behavior
Requests to the public APIs, such as /api/public/v2/contentnode_tree/8f0a5b9d89795/, that have an invalid UUID cause a 500 error.
Sentry Issue: STUDIO-HH7
ValueError: badly formed hexadecimal UUID string
(23 additional frame(s) were not displayed)
...
File "kolibri_public/views.py", line 65, in wrapper_func
response = some_func(*args, **kwargs)
File "kolibri_public/views.py", line 700, in retrieve
queryset = self.get_tree_queryset(request, pk)
File "kolibri_public/views.py", line 646, in get_tree_queryset
if pk and self.filter_queryset(self.get_queryset()).filter(id=pk).exists()
File "kolibri_content/fields.py", line 159, in get_db_prep_value
value = uuid.UUID(value)
Expected behavior
This error is caused by 'bad input', which we still don't want to accept. Although, since the error causes a 500 response, it would be better for us to validate any request input matches what we expect, which in this case the request parameter looks like a UUID, and return a 'Bad Request' response instead. We should do this for all the public APIs.
Activity
[-]ValueError: badly formed hexadecimal UUID string[/-][+]Add defensive checks against URI parameters in the public API[/+]rtibbles commentedon Oct 22, 2024
See here for how this was handled in Kolibri, many of the same strategies should be workable here: learningequality/kolibri#11009
rtibbles commentedon Nov 6, 2024
Fixed in #4794