733629 - Don't return any JSON lists from sync server 2.0

Status: VERIFIED FIXED

(Cloud Services Graveyard :: Server: Sync, defect)

Description

[Toby Elliott [:telliott]]

There's a security issue with JSON arrays and older browsers. We should wrap our lists in some sort of top-level object. I think this only applies to GET /storage/collection, as I believe you moved quotas over to objects.

Comment 1

[Ryan Kelly [:rfkelly]]

So the output will look something like:

 { "items": [{<bso>}, {<bso>}}

Also noting, per conversation with atoll, this opens up the possibility of including additional metadata in the response.

Comment 2

[Ryan Kelly [:rfkelly]]

Attachment: docs patch to return objects rather than lists

Comment 3

[Ryan Kelly [:rfkelly]]

Attachment: code patch to return objects rather than lists

Comment 4

[Toby Elliott [:telliott]]

Comment on attachment 608505 [details] [diff] [review]
code patch to return objects rather than lists

That's an impressive ratio of test changes to code changes.

Comment 5

[Tarek Ziadé (:tarek)]

hey btw, cornice emits a warning if you return lists : there's a xrsf protection

Comment 6

[Ryan Kelly [:rfkelly]]

https://github.com/mozilla-services/server-syncstorage/commit/32549f5bf663bd0825b5fb98e18aced5043946c3

Comment 7

[James Bonacci [:jbonacci]]

Code verified and passed functional tests of Sync 2.0 and AITC 1.0 for a current deploy to qa1.