2036191 - Crash Signature Field Mismatch in Bugzilla REST API

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: API, defect)

Description

[David Lawrence [:dkl]]

Root Cause

The crash signature custom field is not enabled for the Web Compatibility product in Bugzilla
Despite this, the field can be set via REST API (a glitch), which bugbot exploited when "Copying crash signatures from duplicate bugs"
When the bug is later retrieved, the field is absent from the JSON response because it's not enabled for that product — even though the value is stored in the DB

Impact

API responses don't match what's visible in the Web UI
Inconsistent data state between the database and the API

Proposed Fixes

1. Prevent writes — Block setting a field via POST /rest/bug or PUT /rest/bug/:id if it's not enabled for the product
2. Always return set values — Include a field and its value in GET /rest/bug/:id JSON if it has any stored value
3. Expand the allowlist — Add Web Compatibility to the list of products where crash signatures are enabled

Recommended Approach

Options 2 and 3 together would resolve the immediate issue
Option 3 alone is insufficient — it would recur if another non-enabled product's bug gets a crash signature set via the API glitch

Comment 1

[BMO Github Automation]

Attachment: [mozilla-bteam/bmo] Bug 2036191 - Crash Signature Field Mismatch in Bugzilla REST API (#2612)

Comment 2

[BMO Github Automation]

Authored by https://github.com/dklawren
https://github.com/mozilla-bteam/bmo/commit/34cb8f33729c025089952963a0c813fe85920de4
[master] Bug 2036191 - Crash Signature Field Mismatch in Bugzilla REST API