Validate the Jira epic action body and reject reserved dispatch kwargs - #15782
Open
svader0 wants to merge 1 commit into
Open
Validate the Jira epic action body and reject reserved dispatch kwargs#15782svader0 wants to merge 1 commit into
svader0 wants to merge 1 commit into
Conversation
update_jira_epic passed the whole request body into dojo_dispatch_task as keyword arguments. The action already advertised EngagementUpdateJiraEpicSerializer in its schema but never instantiated it, so any key a client sent became a dispatcher keyword and a non-object body raised an unhandled 500. dojo_dispatch_task now also refuses async_user_id and _pgh_context from a caller. The dispatcher injects both itself and no call site supplies them, so this stops a future call site forwarding untrusted keys into the same channel. force_sync, force_async, countdown and ignore_result stop affecting this action. None was in its declared schema and no caller sends them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
POST /api/v2/engagements/{id}/update_jira_epic/passed the whole request body into the Celerydispatcher as keyword arguments. The action's schema already advertises
EngagementUpdateJiraEpicSerializer, but the code never instantiated it. Two results: any key aclient sent became a dispatcher keyword, and a body that was not a JSON object raised an unhandled
500.
This change uses that serializer, so only
epic_nameandepic_priorityreach the dispatcher, anda non-object body returns 400.
dojo_dispatch_tasknow also rejectsasync_user_idand_pgh_contextwhen a caller suppliesthem. The dispatcher injects both itself, and no call site in the codebase passes either one, so
this just makes the contract explicit.
Behaviour changes
All of these are the declared schema being enforced. Nothing in the codebase sends any of them.
force_sync,force_async,countdownandignore_resultstop affecting this action.epic_name, or one over 200 characters, now returns 400.epic_priority: nullstill passes through. Both tasks already handleNone.Tests
Three regression tests in the existing
unittests/test_permissions_audit.py::TestJiraEpicBFLA. Eachone fails without this change.