1387049 - we no longer accept random query args in update pings

Status: RESOLVED WONTFIX

(Release Engineering Graveyard :: Applications: Balrog (backend), enhancement, P3)

Description

[[e-mail] (:bhearsum)]

When we converted the public API spec to Swagger/Connexion, it had the side effect of making us very strict about the parameters we accept. Anything not defined in the spec will cause a 400 error. We should probably loosen up on this and accept any query args in these pings. We've had examples in the past of AV vendors appending additional or even bad arguments, so we know there are real use cases for this.

Comment 1

[[e-mail] (:bhearsum)]

rstrong would like to land bug 1386176 by Beta 3. That goes to build on August 15th, so we need this in prod before that. The 14th is clear of release work, so that seems like a good day to do it. This means we should have this merged to master by Friday, August 11th.

Comment 2

[[e-mail] (:bhearsum)]

Allowing arbitrary parameters is turning out to be trickier than I thought. In OpenAPI 2.0 specs, we cannot have query parameters with arbitrary names - they must be explicitly named. It appears that there is a way to accept them in OpenAPI 3.0, which I hope we'll be able to switch to in the near future.

For the immediate need, I'm going to add explicit support for "mig64". If we can't switch to OpenAPI 3.0 soon we may need to find another workaround.

Comment 3

[[e-mail] (:bhearsum)]

I'm adding a workaround for mig64 in bug 1386756. I had a look in Datadog and Sentry and couldn't find any evidence of an increase in 400s since the public app stopped accepting unknown query args. I still think we should allow this, but given the lack of evidence of it happening in the wild, I don't think this is a priority.

Comment 4

[[e-mail] (:bhearsum)]

Hasn't come up again, I'm going to suggest not allowing this. We can consider it again later if a use case comes up.