jatin-practice / django-rest-interface

Automatically exported from code.google.com/p/django-rest-interface
0 stars 0 forks source link

Malformed JSON input can cause a server error #45

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
1. Create a JSON REST API url that accepts a POST
2. Fire malformed JSON at the url

I would expect a HTTP 400 response code to be generated not a 500 since
this shouldn't trigger a server error - malformed input should never
trigger failure.

Simple patch (note this requires that Django ticket #11970 is fixed,
otherwise the except needs to catch ValueError as well) 

diff --git
a/server/lib/django-rest-interface/django_restapi/model_resource.py
b/server/lib/django-rest-interface/djang
index 97b38d2..79cd46e 100755
--- a/server/lib/django-rest-interface/django_restapi/model_resource.py
+++ b/server/lib/django-rest-interface/django_restapi/model_resource.py
@@ -9,7 +9,7 @@ from django.forms.util import ErrorDict
 from django.utils.functional import curry
 from django.utils.translation.trans_null import _
 from resource import ResourceBase, load_put_and_files, reverse,
HttpMethodNotAllowed
-from receiver import FormReceiver
+from receiver import FormReceiver, InvalidFormData

 class InvalidModelData(Exception):
     """
@@ -140,7 +140,13 @@ class Collection(ResourceBase):
         """
         # Create form filled with POST data
         ResourceForm = models.modelform_factory(self.queryset.model,
form=self.form_class)
-        data = self.receiver.get_post_data(request)
+        try:
+            # with JSON this can raise an exception on malformed input
+            data = self.receiver.get_post_data(request)
+        except InvalidFormData:
+            # Otherwise return a 400 Bad Request error.
+            raise InvalidModelData()
+            
         form = ResourceForm(data)

         # If the data contains no errors, save the model,

Original issue reported on code.google.com by malcolm....@gmail.com on 21 Jan 2010 at 11:31