search

unioslo / mreg

GNU General Public License v3.0
7 stars 13 forks source link

Broken ID usage for BACNetID. #543

Open terjekv opened 1 month ago

terjekv commented 1 month ago

The BACnetID model has a first_unused_id() static method:

https://github.com/unioslo/mreg/blob/bbfcf1828dd0487349d7dd9dfe054d102d2d2a5c/mreg/models/host.py#L78-L97

first_unused_id()does not look like anything that should ever exist... Now, it is used in tests:

https://github.com/unioslo/mreg/blob/bbfcf1828dd0487349d7dd9dfe054d102d2d2a5c/mreg/api/v1/tests/tests_bacnet.py#L17-L22 and https://github.com/unioslo/mreg/blob/bbfcf1828dd0487349d7dd9dfe054d102d2d2a5c/mreg/api/v1/tests/tests_bacnet.py#L30-L32

But, much worse is that the code is used during creation of BACnetID entries:

https://github.com/unioslo/mreg/blob/bbfcf1828dd0487349d7dd9dfe054d102d2d2a5c/mreg/api/v1/views_bacnet.py#L23-L62

This is a fairly classical example of a race condition and should be remedied.