search

inveniosoftware / invenio-rest

REST API support for Invenio.
https://invenio-rest.readthedocs.io
MIT License
2 stars 41 forks source link

Stack trace when CSRF enabled and request on a non-existing route #117

Closed ntarocco closed 3 years ago

ntarocco commented 3 years ago

Stack trace when CSRF enabled and user performs a request on a route that does not exist, e.g. POST /api// (it should be PUT):

AttributeError: 'NoneType' object has no attribute '__module__'
(3 additional frame(s) were not displayed)
...
  File "flask/app.py", line 1821, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "flask/_compat.py", line 39, in reraise
    raise value
  File "flask/app.py", line 1948, in full_dispatch_request
    rv = self.preprocess_request()
  File "flask/app.py", line 2242, in preprocess_request
    rv = func()
  File "invenio_rest/csrf.py", line 243, in csrf_protect
    dest = '{0}.{1}'.format(view.__module__, view.__name__)

The view does not exist and it should be checked.