entrouvert/wcs
entrouvert
/
wcs
14
1
Fork 0
Code Issues Pull Requests 37 Releases Activity

api: use hashlib to validate algo parameter (#47685)

This commit is contained in:
Thomas NOËL 2020-10-14 15:05:31 +02:00
parent 700265f03e
commit cc16562f90
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tests/test_api.py
View File

@ -151,6 +151,8 @@ def test_get_user_from_api_query_string_error_missing_algo(pub):
def test_get_user_from_api_query_string_error_invalid_algo(pub):
output = get_app(pub).get('/api/user/?format=json&orig=coucou&signature=xxx&algo=coin', status=403)
assert output.json['err_desc'] == 'invalid algo'
output = get_app(pub).get('/api/user/?format=json&orig=coucou&signature=xxx&algo=__getattribute__', status=403)
assert output.json['err_desc'] == 'invalid algo'
def test_get_user_from_api_query_string_error_invalid_signature(pub):

2
wcs/api_utils.py
View File

@ -55,6 +55,8 @@ def is_url_signed(utcnow=None, duration=DEFAULT_DURATION):
algo = get_request().form.get('algo')
if not isinstance(algo, six.string_types):
raise AccessForbiddenError('missing/multiple algo field')
if algo not in hashlib.algorithms_guaranteed:
raise AccessForbiddenError('invalid algo')
try:
algo = getattr(hashlib, algo)
except AttributeError: