gdc: escape special characters for XML (#44048)

passerelle/apps/api_particulier/models.py

@@ -214,7 +214,7 @@ class APIParticulier(BaseResource):
     def v2_situation_familiale(self, request, code_postal, numero_allocataire, user=None):
         if not code_postal.strip() or not numero_allocataire.strip():
             raise APIError('missing code_postal or numero_allocataire', status_code=400)
-        return self.get('v2/situation-familiale', params={
+        return self.get('v2/composition-familiale', params={
             'codePostal': code_postal,
             'numeroAllocataire': numero_allocataire,
         }, user=user)

passerelle/apps/gdc/models.py

@@ -62,27 +62,42 @@ class Gdc(BaseResource):
         verbose_name = _('GDC Web Service')
 
     def call_soap(self, action, *args, **kwargs):
+
+        def escape(s):
+            return force_text(s).replace('&', '&amp;').replace('>', '&gt;').replace('<', '&lt;')
+
         params = []
         for i, arg in enumerate(args):
-            params.append('<v%(i)s xsi:type="xsd:string">%(value)s</v%(i)s>' % {'i': i + 1, 'value': arg})
+            params.append('<v%(i)s xsi:type="xsd:string">%(value)s</v%(i)s>' % {
+                'i': i + 1, 'value': escape(arg)})
         for key, value in kwargs.items():
+            if value is None:
+                params.append('<%s xsi:null="1"/>' % key)
+                continue
             type_ = 'int' if isinstance(value, int) else 'string'
             params.append('<%(key)s xsi:type="xsd:%(type)s">%(value)s</%(key)s>' % {
-                'key': key, 'type': type_, 'value': value})
+                'key': key, 'type': type_, 'value': escape(value)})
 
         data = """<?xml version="1.0" encoding="UTF-8"?>
 <SOAP-ENV:Envelope
   SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
   xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
+  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"
   xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
+  xmlns:xsd="http://www.w3.org/1999/XMLSchema"
 >
 <SOAP-ENV:Body>
 <%(action)s SOAP-ENC:root="1">
 %(params)s
 </%(action)s>
 </SOAP-ENV:Body>
-</SOAP-ENV:Envelope>""" % {'action': action, 'params': ''.join(params)}
-        resp = self.requests.post(self.service_url, data=data)
+</SOAP-ENV:Envelope>""" % {'action': action, 'params': '\n'.join(params)}
+        resp = self.requests.post(
+                self.service_url,
+                data=data.encode('utf-8'),
+                headers={'SOAPAction': '"%s"' % action,
+                         'Content-type': 'text/xml; charset=UTF-8'})
+
         return ET.ElementTree(ET.fromstring(resp.content))
 
     @endpoint()

passerelle/apps/gdc/views.py

@@ -120,7 +120,7 @@ class PostDemandeView(View, SingleObjectMixin):
     model = Gdc
 
     @utils.protected_api('can_post_request')
-    def get(self, request, *args, **kwargs):
+    def post(self, request, *args, **kwargs):
         # <wsdl:message name='addDemandeExterneParticulierRequest'>
         #   <wsdl:part name='nom' type='xsd:string'></wsdl:part>
         #   <wsdl:part name='prenom' type='xsd:string'></wsdl:part>

tests/test_api_particulier.py

@@ -97,7 +97,7 @@ def api_particulier_v2_avis_imposition(url, request):
     return response(200, SVAIR_RESPONSE, request=request)
 
 @urlmatch(netloc=r'^particulier.*\.api\.gouv\.fr$',
-          path=r'^/api/v2/situation-familiale$')
+          path=r'^/api/v2/composition-familiale$')
 def api_particulier_v2_situation_familiale(url, request):
     return response(200, CAF_FAMILLE, request=request)