Add input string checks to the branch and format arguments

Make sure no UTF8 characters are allowed and return an error if they
are.

Also includes tests to make sure the correct error is returned.

src/pylorax/api/v0.py

@@ -1018,6 +1018,9 @@ def v0_api(api):
     def v0_blueprints_list():
         """List the available blueprints on a branch."""
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             limit = int(request.args.get("limit", "20"))
             offset = int(request.args.get("offset", "0"))
@@ -1038,7 +1041,13 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         out_fmt = request.args.get("format", "json")
+        if VALID_API_STRING.match(out_fmt) is None:
+            return jsonify(status=False, errors=["Invalid characters in format argument"]), 400
+
         blueprints = []
         changes = []
         errors = []
@@ -1099,6 +1108,9 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             limit = int(request.args.get("limit", "20"))
             offset = int(request.args.get("offset", "0"))
@@ -1128,6 +1140,9 @@ def v0_api(api):
     def v0_blueprints_new():
         """Commit a new blueprint"""
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             if request.headers['Content-Type'] == "text/x-toml":
                 blueprint = recipe_from_toml(request.data)
@@ -1159,6 +1174,9 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             with api.config["GITLOCK"].lock:
                 delete_recipe(api.config["GITLOCK"].repo, branch, blueprint_name)
@@ -1173,6 +1191,9 @@ def v0_api(api):
     def v0_blueprints_workspace():
         """Write a blueprint to the workspace"""
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             if request.headers['Content-Type'] == "text/x-toml":
                 blueprint = recipe_from_toml(request.data)
@@ -1200,6 +1221,9 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             with api.config["GITLOCK"].lock:
                 workspace_delete(api.config["GITLOCK"].repo, branch, blueprint_name)
@@ -1221,6 +1245,9 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             with api.config["GITLOCK"].lock:
                 revert_recipe(api.config["GITLOCK"].repo, branch, blueprint_name, commit)
@@ -1244,6 +1271,9 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             with api.config["GITLOCK"].lock:
                 tag_recipe_commit(api.config["GITLOCK"].repo, branch, blueprint_name)
@@ -1268,6 +1298,9 @@ def v0_api(api):
                 return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         try:
             if from_commit == "NEWEST":
                 with api.config["GITLOCK"].lock:
@@ -1310,7 +1343,13 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         out_fmt = request.args.get("format", "json")
+        if VALID_API_STRING.match(out_fmt) is None:
+            return jsonify(status=False, errors=["Invalid characters in format argument"]), 400
+
         blueprints = []
         errors = []
         for blueprint_name in [n.strip() for n in sorted(blueprint_names.split(","), key=lambda n: n.lower())]:
@@ -1368,6 +1407,9 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         branch = request.args.get("branch", "master")
+        if VALID_API_STRING.match(branch) is None:
+            return jsonify(status=False, errors=["Invalid characters in branch argument"]), 400
+
         blueprints = []
         errors = []
         for blueprint_name in [n.strip() for n in sorted(blueprint_names.split(","), key=lambda n: n.lower())]:
@@ -1492,6 +1534,8 @@ def v0_api(api):
             return jsonify(status=False, errors=["Invalid characters in API path"]), 400
 
         out_fmt = request.args.get("format", "json")
+        if VALID_API_STRING.match(out_fmt) is None:
+            return jsonify(status=False, errors=["Invalid characters in format argument"]), 400
 
         # Return info on all of the sources
         if source_names == "*":
@@ -1660,7 +1704,7 @@ def v0_api(api):
 
         if not modules:
             msg = "one of the requested modules does not exist: %s" % module_names
-            log.error("(v0_modules_info) %s" % msg)
+            log.error("(v0_modules_info) %s", msg)
             return jsonify(status=False, errors=[msg]), 400
 
         return jsonify(modules=modules)

tests/pylorax/test_server.py

@@ -1022,7 +1022,12 @@ class ServerTestCase(unittest.TestCase):
         self.assertNotEqual(data, None)
         self.assertEqual(resp.status_code, 400)
         self.assertEqual(data["status"], False)
-        self.assertEqual(data["errors"], ["Invalid characters in API path"])
+        self.assertTrue(len(data["errors"]) > 0)
+        self.assertTrue("Invalid characters in" in data["errors"][0])
+
+    def test_blueprints_list_branch(self):
+        resp = self.server.get("/api/v0/blueprints/list?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
 
     def test_blueprints_info_input(self):
         """Test the blueprints/info input character checking"""
@@ -1030,12 +1035,21 @@ class ServerTestCase(unittest.TestCase):
         resp = self.server.get("/api/v0/blueprints/info/" + UTF8_TEST_STRING)
         self.assertInputError(resp)
 
+        resp = self.server.get("/api/v0/blueprints/info/http-server?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
+        resp = self.server.get("/api/v0/blueprints/info/http-server?format=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_changes_input(self):
         """Test the blueprints/changes input character checking"""
         # /api/v0/blueprints/changes/<blueprint_names>
         resp = self.server.get("/api/v0/blueprints/changes/" + UTF8_TEST_STRING)
         self.assertInputError(resp)
 
+        resp = self.server.get("/api/v0/blueprints/changes/http-server?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_new_input(self):
         """Test the blueprints/new input character checking"""
         # /api/v0/blueprints/new
@@ -1053,11 +1067,20 @@ class ServerTestCase(unittest.TestCase):
                                 content_type="application/json")
         self.assertInputError(resp)
 
+        test_blueprint["name"] = "glusterfs"
+        resp = self.server.post("/api/v0/blueprints/new?branch=" + UTF8_TEST_STRING,
+                                data=json.dumps(test_blueprint),
+                                content_type="application/json")
+        self.assertInputError(resp)
+
     def test_blueprints_delete_input(self):
         """Test the blueprints/delete input character checking"""
         resp = self.server.delete("/api/v0/blueprints/delete/" + UTF8_TEST_STRING)
         self.assertInputError(resp)
 
+        resp = self.server.delete("/api/v0/blueprints/delete/http-server?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_workspace_input(self):
         """Test the blueprints/workspace input character checking"""
         test_blueprint = {"description": "An example GlusterFS server with samba, ws version",
@@ -1074,37 +1097,64 @@ class ServerTestCase(unittest.TestCase):
                                 content_type="application/json")
         self.assertInputError(resp)
 
+        test_blueprint["name"] = "glusterfs"
+        resp = self.server.post("/api/v0/blueprints/workspace?branch=" + UTF8_TEST_STRING,
+                                data=json.dumps(test_blueprint),
+                                content_type="application/json")
+        self.assertInputError(resp)
+
     def test_blueprints_workspace_delete_input(self):
         """Test the DELETE blueprints/workspace input character checking"""
         resp = self.server.delete("/api/v0/blueprints/workspace/" + UTF8_TEST_STRING)
         self.assertInputError(resp)
 
+        resp = self.server.delete("/api/v0/blueprints/workspace/http-server?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_undo_input(self):
         """Test the blueprints/undo/... input character checking"""
         resp = self.server.post("/api/v0/blueprints/undo/" + UTF8_TEST_STRING + "/deadbeef")
         self.assertInputError(resp)
 
+        resp = self.server.post("/api/v0/blueprints/undo/http-server/deadbeef?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_tag_input(self):
         """Test the blueprints/tag input character checking"""
         resp = self.server.post("/api/v0/blueprints/tag/" + UTF8_TEST_STRING)
         self.assertInputError(resp)
 
+        resp = self.server.post("/api/v0/blueprints/tag/http-server?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_diff_input(self):
         """Test the blueprints/diff input character checking"""
         # /api/v0/blueprints/diff/<blueprint_name>/<from_commit>/<to_commit>
         resp = self.server.get("/api/v0/blueprints/diff/" + UTF8_TEST_STRING + "/NEWEST/WORKSPACE")
         self.assertInputError(resp)
 
+        resp = self.server.get("/api/v0/blueprints/diff/http-server/NEWEST/WORKSPACE?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_freeze_input(self):
         """Test the blueprints/freeze input character checking"""
         resp = self.server.get("/api/v0/blueprints/freeze/" + UTF8_TEST_STRING)
         self.assertInputError(resp)
 
+        resp = self.server.get("/api/v0/blueprints/freeze/http-server?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
+        resp = self.server.get("/api/v0/blueprints/freeze/http-server?format=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_blueprints_depsolve_input(self):
         """Test the blueprints/depsolve input character checking"""
         resp = self.server.get("/api/v0/blueprints/depsolve/" + UTF8_TEST_STRING)
         self.assertInputError(resp)
 
+        resp = self.server.get("/api/v0/blueprints/depsolve/http-server?branch=" + UTF8_TEST_STRING)
+        self.assertInputError(resp)
+
     def test_projects_info_input(self):
         """Test the projects/info input character checking"""
         resp = self.server.get("/api/v0/projects/info/" + UTF8_TEST_STRING)