Consistent 400 Response for Invalid Input in Kolibri Public Content APIs

kolibri/core/content/api.py

@@ -5,6 +5,7 @@
 from collections import OrderedDict
 from functools import reduce
 from random import sample
+from uuid import UUID
 
 from django.core.cache import cache
 from django.core.exceptions import ValidationError
@@ -862,6 +863,14 @@ class ContentNodeViewset(InternalContentNodeMixin, RemoteMixin, ReadOnlyValuesVi
     def retrieve(self, request, pk=None):
         if pk is None:
             raise Http404
+
+        try:
+            UUID(pk)
+        except ValueError:
+            return Response(
+                {"error": "Invalid UUID format."}, status=status.HTTP_400_BAD_REQUEST
+            )
+
         if self._should_proxy_request(request):
             if self.get_queryset().filter(admin_imported=True, pk=pk).exists():
                 # Used in the update method for remote request retrieval

kolibri/core/content/public_api.py

@@ -3,6 +3,8 @@
 from django.db import connection
 from django.db.models import Q
 from django.http import HttpResponseBadRequest
+from django.shortcuts import get_object_or_404
+from rest_framework import status
 from rest_framework.response import Response
 from rest_framework.serializers import Serializer
 from rest_framework.viewsets import GenericViewSet
@@ -50,6 +52,13 @@ def retrieve(self, request, pk=None):
         :param pk: id parent node
         :return: an object with keys for each content metadata table and a schema_version key
         """
+        try:
+            UUID(pk)
+        except ValueError:
+            return Response(
+                {"error": "Invalid UUID format."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
 
         content_schema = request.query_params.get(
             "schema_version", self.default_content_schema
@@ -72,7 +81,7 @@ def retrieve(self, request, pk=None):
 
         # Get the model for the target node here - we do this so that we trigger a 404 immediately if the node
         # does not exist.
-        node = self.get_object()
+        node = get_object_or_404(models.ContentNode.objects.all(), pk=pk)
 
         nodes = node.get_ancestors(include_self=True)
 

kolibri/core/content/test/test_content_app.py

@@ -506,15 +506,24 @@ def test_contentnode_tree_filtered_queryset_node(self):
         )
         self.assertEqual(response.status_code, 404)
 
-    def test_contentnode_tree_bad_pk(self):
+    def test_contentnode_tree_none_pk(self):
         response = self.client.get(
             reverse(
                 "kolibri:core:contentnode_tree-detail",
-                kwargs={"pk": "this is not a UUID"},
+                kwargs={"pk": None},
             )
         )
         self.assertEqual(response.status_code, 404)
 
+    def test_contentnode_tree_bad_pk(self):
+        response = self.client.get(
+            reverse(
+                "kolibri:core:contentnode_tree-detail",
+                kwargs={"pk": "this is not UUID"},
+            )
+        )
+        self.assertEqual(response.status_code, 400)
+
     @unittest.skipIf(
         getattr(settings, "DATABASES")["default"]["ENGINE"]
         == "django.db.backends.postgresql",

kolibri/core/content/test/test_public_api.py

@@ -95,6 +95,25 @@ def test_schema_version_too_high(self):
         )
         self.assertEqual(response.status_code, 400)
 
+    def test_import_metadata_none_pk(self):
+        response = self.client.get(
+            reverse(
+                "kolibri:core:importmetadata-detail",
+                kwargs={"pk": None},
+            )
+        )
+        self.assertEqual(response.status_code, 404)
+
+    def test_import_metadata_bad_pk(self):
+        response = self.client.get(
+            reverse(
+                "kolibri:core:importmetadata-detail",
+                kwargs={"pk": "this is not a UUID"},
+            )
+        )
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.data["error"], "Invalid UUID format.")
+
     def test_schema_version_just_right(self):
         response = self.client.get(
             reverse("kolibri:core:importmetadata-detail", kwargs={"pk": self.node.id})