647342 - Unvalidated GET parameters in views.py

Status: VERIFIED FIXED

(Websites Graveyard :: markup.mozilla.org, defect)

Description

[Fred Wenzel [:wenzel]]

In markup.views.community:

    if 'offset' in request.GET:
        offset = int(request.GET['offset'])
        per_page = int(request.GET['per_page'])

This will error out and throw a 500 page in two cases: If offset or per_page is not a number, and if offset is present but per_page is not.

Feel free to just throw an error 400 if you catch any of these errors (unless, of course, this is a use case the user can legitimately reach by making an error other than messing with the URL).

Comment 1

[Fred Wenzel [:wenzel]]

Also keep in mind that if the user inputs something like offset=1&per_page=-12, these two lines will pass, but the request will fail further down in this function, when all this is stuffed into the model. Catch that too, please.

Comment 2

[Adam Miller]

I believe this was fixed here: https://github.com/mozilla/markup/commit/a21465606e4a5e33feefa56835eb53386e415cc5

Comment 3

[Matt Brandt [:mbrandt]]

Fred, can you review the code fix in comment 2? Thanks.

Comment 4

[Fred Wenzel [:wenzel]]

Yup, looks good.

Comment 5

[Matt Brandt [:mbrandt]]

Fantastic! Thanks Fred.