statgen / bravo_api

Server side data processing and retrieval endpoints for BRAVO
MIT License
1 stars 2 forks source link

Check content_length prior to parsing request data. #8

Open grosscol opened 3 years ago

grosscol commented 3 years ago

Issue or current state

A number of requests imported from the UI flask application check the request data with request.get_json(). Recommendation in Flask documentation is to check content length prior to loading & parsing the request data.

Resolved when

Define a max length for the ui routes blueprint content bodies e.g. CONTENT_LEN_MAX = 65536

Replace existing checks for json content of a post request

if request.method == 'POST' and request.get_json():  

with type and length check before proceeding with request.get_json()

if request.method == 'POST' and  request.is_json and request.content_length < CONTENT_LEN_MAX: