fix(server): should validate request payload: ensure id is not specified #291
Conversation
|
I think it's worthwhile to do the same check everywhere else that we accept JSON from the client. You could search the codebase for For example: Another possibility (that I haven't read into too much yet) would be to use a request filter: https://quarkus.io/guides/resteasy-reactive#request-or-response-filters This in theory lets you install a hook that will get called before every HTTP request is handled, so you can inspect it and perform validations. For example, you could check for |
|
/build_test |
|
Workflow started at 3/6/2024, 12:41:08 PM. View Actions Run. |
|
CI build and push: All tests pass ✅ (JDK21) |
|
CI build and push: At least one test failed ❌ (JDK17) |
aali309
force-pushed
the
removeIdfromUploadedRule
branch
3 times, most recently
from
6a7616f to
a5c9532
Compare
aali309
force-pushed
the
removeIdfromUploadedRule
branch
from
a5c9532 to
7be94a1
Compare
|
/build_test |
|
Workflow started at 3/6/2024, 1:04:55 PM. View Actions Run. |
|
CI build and push: All tests pass ✅ (JDK21) |
|
CI build and push: All tests pass ✅ (JDK17) |
|
/build_test |
|
Workflow started at 3/6/2024, 8:50:51 PM. View Actions Run. |
|
CI build and push: All tests pass ✅ (JDK21) |
|
CI build and push: All tests pass ✅ (JDK17) |
|
/build_test |
|
Workflow started at 3/7/2024, 11:46:40 AM. View Actions Run. |
|
CI build and push: All tests pass ✅ (JDK21) |
|
CI build and push: All tests pass ✅ (JDK17) |
Welcome to Cryostat3! 👋
Before contributing, make sure you have:
mainbranch[chore, ci, docs, feat, fix, test]To recreate commits with GPG signature
git fetch upstream && git rebase --force --gpg-sign upstream/mainFixes: #278
Description of the change:
Server should validates the request payload and ensures that the id field is not specified. If fails validation, server responds with a 400/409 status before it even gets to the database.
Motivation for the change:
Mentioned by @andrewazores Link
How to manually test: