1246150 - Incorrectly formatted JSON data pass to the REST API is not caught on time in 5.0

Status: NEW

(Bugzilla :: WebService, defect)

Description

[Patrice Clement]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Build ID: 20151226014444

Steps to reproduce:

Hello there. I'm a Gentoo developer trying to talk to our Bugzilla server, which has recently been migrated to Bugzilla 5.0.2, via the new REST API. The server is located at the following URL: https://bugs.gentoo.org. I'm using the Python requests module to forge HTTP GET/PUT requests as suggested by [1] instead of the now deprecated XMLRPC API. When updating a bug (actually closing it) and inserting a comment, I'm running into a Perl error, happening on the server end. Here's are the steps I'm going through:
$ python3
Python 3.3.5 (default, Mar 15 2015, 21:31:45) 
[GCC 4.8.3] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> login = requests.get('https://bugs.gentoo.org/rest/login?login=[e-mail]&password=sikret'
>>> tok = login.json()['token']
>>> uri = 'https://bugs.gentoo.org/rest/bug/570836'
>>> params = {'ids': ['570836'], 'status': 'RESOLVED', 'comment': {'body': "This is a comment", 'token': tok, 'resolution': 'FIXED'}
>>> r = requests.put(uri, params)                                                                        
>>> r.ok
True
>>> r.status_code
200
>>> r.json()
{'code': 100500, 'message': 'Can\'t use string ("body") as a HASH ref while "strict refs" in use at Bugzilla/WebService/Bug.pm line 636.\n', 'documentation': 'http://www.bugzilla.org/docs/tip/en/html/api/', 'error': True}

Of course, even though the status code I get back from Bugzilla is 200, an error occurs and the state of the bug remains the exact same. If I pop the "comment" dictionary out of "params", it works just fine and I can mark the bug as FIXED, but that's not my intention here. I'd like to stick a comment in the bug AND close it at the same time. According to [2], comment must be an "object" (I take it it must be a dictionary) that has to contain a "body" field/key with the comment in question. Any idea what I'm doing wrong? Thanks a lot for your help!

[1]: https://wiki.mozilla.org/Bugzilla:REST_API
[2]: http://bugzilla.readthedocs.org/en/latest/api/core/v1/bug.html#update-bug


Actual results:

I wasn't able to write a comment in the bug AND close it.


Expected results:

Bug should have been closed along with a comment.

Comment 1

[Dylan Hardison [:dylan] (he/him)]

%values by line 636 looks like this:

dylan@bugzilla ~(master)% perl -MAlive -e Alive::run                                                                          
---
bug_status: RESOLVED
comment: body
other_bugs:
  - assigned_to: 1
    bug_file_loc: ''
    bug_id: 1
    bug_severity: normal
    bug_status: CONFIRMED
    cclist_accessible: 1
    component_id: 1
    creation_ts: 2015-12-28 19:56:20
    deadline: ~
    delta_ts: 2015-12-28 19:56:20
    estimated_time: 0.00
    everconfirmed: 1
    lastdiffed: 2015-12-28 19:56:20
    op_sys: Mac OS
    priority: Highest
    product_id: 1
    qa_contact: ~
    remaining_time: 0.00
    rep_platform: PC
    reporter_accessible: 1
    reporter_id: 1
    resolution: ''
    short_desc: PANTS
    status_whiteboard: ''
    target_milestone: ---
    version: unspecified
resolution: FIXED

Comment 2

[Frédéric Buclin]

(In reply to Patrice Clement from comment #0)

> >>> params = {'ids': ['570836'], 'status': 'RESOLVED', 'comment': {'body': "This is a comment", 'token': tok, 'resolution': 'FIXED'}

The token and resolution fields are part of the comment object here, which is wrong.

I tried to reproduce the problem myself, on both master and 5.0.2, but it's working fine.

Comment 3

[Patrice Clement]

Please disregard the code I wrote in the summary (cause I got mixed up wit curly braces) and use this one instead:
https://bpaste.net/show/b3a8f5708175

Comment 4

[Frédéric Buclin]

When testing your code against master, your data is correctly rejected with:

'When using JSON-RPC over POST, you cannot send data as application/x-www-form-urlencoded. Only application/json and application/json-rpc are allowed.'

For some reason, the REST API in 5.0.2 doesn't catch it. It dies later with the error you saw.

So the good news is that the 'bug update' code is not broken. Please convert your Python data to valid JSON data before calling the REST API.

Comment 5

[Patrice Clement]

Thanks for guiding me in the right direction. Indeed, my data wasn't correctly forged and it was upsetting Bugzilla somehow. It's all good now and I can close bugs with REST! Yay!
Here's the code snippet: https://bpaste.net/show/fe0fff884fbb
The bug I ran the code against: https://bugs.gentoo.org/show_bug.cgi?id=570836#c11

I have one complain though: the documentation in the wiki [1][2] is a bit lacking, incomplete and might not reflect the actual correct use of the Bugzilla REST API, and the subtle tweaks the API requires: make the data JSON compliant, forge HTTP headers, etc. Please fill this gap. Feel free to reuse my code if necessary and of course, close this bug as you see fit. Thank you!

[1]: https://wiki.mozilla.org/Bugzilla:REST_API
[2]: http://bugzilla.readthedocs.org/en/latest/api/

Comment 6

[Frédéric Buclin]

(In reply to Patrice Clement from comment #5)
> I have one complain though: the documentation in the wiki [1][2] is a bit
> lacking, incomplete and might not reflect the actual correct use of the
> Bugzilla REST API, and the subtle tweaks the API requires: make the data
> JSON compliant, forge HTTP headers, etc.

The documentation at http://bugzilla.readthedocs.org/en/latest/api/core/v1/general.html clearly details all these points already. The example in the wiki page is not a complete Python script, and can certainly be updated, though.

Comment 7

[David Lawrence [:dkl]]

(In reply to Frédéric Buclin from comment #6)
> (In reply to Patrice Clement from comment #5)
> > I have one complain though: the documentation in the wiki [1][2] is a bit
> > lacking, incomplete and might not reflect the actual correct use of the
> > Bugzilla REST API, and the subtle tweaks the API requires: make the data
> > JSON compliant, forge HTTP headers, etc.
> 
> The documentation at
> http://bugzilla.readthedocs.org/en/latest/api/core/v1/general.html clearly
> details all these points already. The example in the wiki page is not a
> complete Python script, and can certainly be updated, though.

The readthedocs documentation should always be considered authoritative over the wiki docs. The wiki docs were there before we wrote the API docs for readthedocs and is understandable it might not be accurate. Please file bugs reports for issues with the readthedocs documentation and we will get it fixed up. The readthedocs is auto-built as soon as we commit to the tree and does not need to wait for specific releases to ship.

dkl