Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not treat empty non-form input as HTML. #4566

Merged
merged 6 commits into from
Oct 12, 2016
Merged

Do not treat empty non-form input as HTML. #4566

merged 6 commits into from
Oct 12, 2016

Conversation

tomchristie
Copy link
Member

@tomchristie tomchristie commented Oct 12, 2016 •
edited
Loading

HTML form input has slightly differing behavior than non-form input. In particular any empty BooleanField is treated as False by default, because empty checkboxes do not send any value through.

For the case where no data is included in the request body we shouldn't treat this as an HTML input, unless a form content type has been explicitly included. (nb. have confirmed that at least chrome still includes the form content type with 0 length body in the case of submitting a form with a single empty checkbox.)

Refs. #3649
Closes #3891 - thanks for your work @callorico! 😄
Closes #3892
Closes #3647

This change isn't perfect, but it is the most minimal change that we can make in order to fix the main issue. (BooleanField treated as True for empty input)

Other options would have been:

  • Use the None sentinel for non-form data. (but don't want to go that way because it'd play less well with Django's existing behavior, and could easily break existing codebases)
  • Parse empty content which has a media type included. (don't want to go that way because likely there are clients that always include Content-Type application/json regardless of if a body is included or not, and we don't want to fail for all of them.)

callorico and others added 6 commits February 1, 2016 18:19
@tomchristie tomchristie added this to the 3.5.0 Release milestone Oct 12, 2016
@tomchristie tomchristie merged commit 5677d06 into master Oct 12, 2016
@tomchristie tomchristie deleted the callorico-master branch October 12, 2016 14:46
craigds added a commit to koordinates/django-rest-framework that referenced this pull request Feb 23, 2017
@craigds
Return Empty when getting listserializers from empty html input
5d11876 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
craigds added a commit to koordinates/django-rest-framework that referenced this pull request Feb 24, 2017
@craigds
Return Empty when getting listserializers from empty html input
1f61d6d 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
@Reskov
Copy link

Reskov commented Jul 28, 2017

Hi, @tomchristie is this line correct? 5677d06#diff-6dc9b019ec1d96c56e0e31dac3bba51cR302

This line of code was added at this pull request, therefore I am asking here.

if media_type and not is_form_media_type(media_type):
      empty_data = QueryDict('', encoding=self._request._encoding)
else:
      empty_data = {}

I suppose returning QueryDict should be only for form data type, not for anyone other. In my case I was sending empty request with content-type application/json and received immutable QueryDict(). Is this correct?

craigds added a commit to koordinates/django-rest-framework that referenced this pull request May 9, 2018
@craigds
Return Empty when getting listserializers from empty html input
a03cb05 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
craigds added a commit to koordinates/django-rest-framework that referenced this pull request May 9, 2018
@craigds
Return Empty when getting listserializers from empty html input
de82a51 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
craigds added a commit to koordinates/django-rest-framework that referenced this pull request Jun 14, 2018
@craigds
Return Empty when getting listserializers from empty html input
92fa5da 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
craigds added a commit to koordinates/django-rest-framework that referenced this pull request Jun 14, 2018
@craigds
Return Empty when getting listserializers from empty html input
220605e 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
craigds added a commit to koordinates/django-rest-framework that referenced this pull request Jun 14, 2018
@craigds
Return Empty when getting listserializers from empty html input
a762a0a 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
hamishcampbell pushed a commit to koordinates/django-rest-framework that referenced this pull request Oct 8, 2018
@craigds @hamishcampbell
Return Empty when getting listserializers from empty html input
56ff3c6 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
peterthomassen added a commit to peterthomassen/django-rest-framework that referenced this pull request Feb 17, 2020
@peterthomassen
Do not treat empty payload as empty dict
203e0a0 
This allows views to distinguish missing payload from empty payload.

Related: encode#3647, encode#4566
@peterthomassen peterthomassen mentioned this pull request Feb 17, 2020
Closed
peterthomassen added a commit to peterthomassen/django-rest-framework that referenced this pull request Feb 20, 2020
@peterthomassen
Do not treat missing non-form data as empty dict
388b0ac 
This allows views to distinguish missing payload from empty payload.

Related: encode#3647, encode#4566
peterthomassen added a commit to peterthomassen/django-rest-framework that referenced this pull request Feb 24, 2020
@peterthomassen
Do not treat missing non-form data as empty dict
c26eb31 
This allows views to distinguish missing payload from empty payload.

Related: encode#3647, encode#4566
@peterthomassen peterthomassen mentioned this pull request Feb 24, 2020
Open
craigds added a commit to koordinates/django-rest-framework that referenced this pull request Jun 1, 2021
@craigds
Return Empty when getting listserializers from empty html input
0c5d7b9 
If a non-required nested list serializer is *not* included in
postdata from an HTML form, the field validation nonetheless returns
an empty list.

This means you can easily clobber existing data when PUTting to
an existing resource, just by not including some list fields.

This is made worse by DRF treating skipping request parsing for empty input.
- encode#3647 and encode#4566 are "fixed" but do not appear to fix the problem;
empty JSON posts still skip request parsing, and list fields not included in
the post still get set to empty lists.
peterthomassen added a commit to peterthomassen/django-rest-framework that referenced this pull request Jun 18, 2021
@peterthomassen
Do not treat missing non-form data as empty dict
8b52dc0 
This allows views to distinguish missing payload from empty payload.

Related: encode#3647, encode#4566
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Bug
Projects
None yet
Milestone
3.5.0 Release
Development

Successfully merging this pull request may close these issues.

BooleanField default values not used when an empty POST is sent Empty requests treated differently from '{}'
3 participants
@tomchristie @Reskov @callorico