yougov / velociraptor

BSD 3-Clause "New" or "Revised" License
11 stars 1 forks source link

Swarm env YAML not validated correctly upon PATCH #211

Open sd2k opened 7 years ago

sd2k commented 7 years ago

I attempted to patch a swarm's env_yaml field with an invalid value and the request was accepted. After that the swarm could not be loaded, presumably because it was failing to parse the invalid yaml. I worked around this by using the admin interface to reset the YAML, but it should be rejected when the PATCH request is made.

sd2k commented 7 years ago

Here's an example request made to the API:

$ http --print hHbB --auth $YG_USERNAME:$YG_PASSWORD patch https://deploy.yougov.net/api/v1/swarms/802/ env_yaml='$ENV_YAML'           
PATCH /api/v1/swarms/802/ HTTP/1.1
Accept: application/json, */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 25
Content-Type: application/json
Host: deploy.yougov.net
User-Agent: HTTPie/0.9.9

{
    "env_yaml": "$ENV_YAML"
}

HTTP/1.1 202 ACCEPTED
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Date: Thu, 12 Jan 2017 13:25:21 GMT
Server: gunicorn/0.17.2
Set-Cookie: csrftoken=rzH1qm1uFN5Yf8QiTS30qZteQaaX6mc2; expires=Thu, 11-Jan-2018 13:25:21 GMT; Max-Age=31449600; Path=/
Transfer-Encoding: chunked
Vary: Accept, Cookie