application: missing manifest in bundle on install (#88069)

hobo/applications/views.py

@@ -456,7 +456,11 @@ class Install(FormView):
         tar_io = io.BytesIO(self.request.FILES['bundle'].read())
         try:
             with tarfile.open(fileobj=tar_io) as tar:
-                manifest = json.loads(tar.extractfile('manifest.json').read().decode())
+                try:
+                    manifest = json.loads(tar.extractfile('manifest.json').read().decode())
+                except KeyError:
+                    form.add_error('bundle', _('Invalid tar file, missing manifest.'))
+                    return self.form_invalid(form)
                 if self.application and self.application.slug != manifest.get('slug'):
                     form.add_error(
                         'bundle',

tests/test_application.py

@@ -1182,6 +1182,22 @@ def test_deploy_application(app, admin_user, settings, app_bundle, app_bundle_wi
     resp = resp.form.submit()
     assert resp.context['form'].errors == {'bundle': ['Invalid tar file.']}
 
+    # missing manifest
+    tar_io = io.BytesIO()
+    with tarfile.open(mode='w', fileobj=tar_io) as tar:
+        foo_fd = io.BytesIO(json.dumps({'foo': 'bar'}, indent=2).encode())
+        tarinfo = tarfile.TarInfo('foo.json')
+        tarinfo.size = len(foo_fd.getvalue())
+        tar.addfile(tarinfo, fileobj=foo_fd)
+    resp = app.get('/applications/')
+    if action == 'Update':
+        with StatefulHTTMock(mocked_http2):
+            resp = resp.click(href='manifest/test/')
+    resp = resp.click(action)
+    resp.form['bundle'] = Upload('app.tar', tar_io.getvalue(), 'application/x-tar')
+    resp = resp.form.submit()
+    assert resp.context['form'].errors == {'bundle': ['Invalid tar file, missing manifest.']}
+
 
 def test_update_application(app, admin_user, settings, app_bundle):
     Wcs.objects.create(base_url='https://wcs.example.invalid', slug='foobar', title='Foobar')