vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #598 from coreos-inc/limitbadquery

Browse source 
Prevent unlimited insane query from running and fix tests
This commit is contained in:
josephschorr 2015-10-05 21:29:35 -04:00
commit 3e7a95407b
4 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
endpoints/api/repository.py
View file

@ -146,6 +146,10 @@ class RepositoryList(ApiResource):
starred_repos = model.repository.get_user_starred_repositories(get_authenticated_user()) starred_repos = model.repository.get_user_starred_repositories(get_authenticated_user())
star_lookup = set([repo.id for repo in starred_repos]) star_lookup = set([repo.id for repo in starred_repos])
# If the user asked for only public repositories, limit to only public repos.
if public and (not namespace and not starred):
username = None
# Find the matching repositories. # Find the matching repositories.
repositories = model.repository.get_visible_repositories(username=username, repositories = model.repository.get_visible_repositories(username=username,
limit=limit, limit=limit,
@ -177,6 +181,8 @@ class RepositoryList(ApiResource):
def get(self, args): def get(self, args):
""" Fetch the list of repositories visible to the current user under a variety of situations. """ Fetch the list of repositories visible to the current user under a variety of situations.
""" """
if not args['namespace'] and not args['starred'] and not args['public']:
raise InvalidRequest('namespace, starred or public are required for this API call')
repositories, star_lookup = self._load_repositories(args['namespace'], args['public'], repositories, star_lookup = self._load_repositories(args['namespace'], args['public'],
args['starred'], args['limit'], args['starred'], args['limit'],

3
endpoints/v1/index.py
View file

@ -329,7 +329,8 @@ def get_search():
username = user.username username = user.username
results = [] results = []
conduct_repo_search(username, query, results) if query:
conduct_repo_search(username, query, results)
data = { data = {
"query": query, "query": query,

8
test/test_api_security.py
View file

@ -378,16 +378,16 @@ class TestRepositoryList(ApiTestCase):
self._set_url(RepositoryList) self._set_url(RepositoryList)
def test_get_anonymous(self): def test_get_anonymous(self):
self._run_test('GET', 200, None, None) self._run_test('GET', 400, None, None)
def test_get_freshuser(self): def test_get_freshuser(self):
self._run_test('GET', 200, 'freshuser', None) self._run_test('GET', 400, 'freshuser', None)
def test_get_reader(self): def test_get_reader(self):
self._run_test('GET', 200, 'reader', None) self._run_test('GET', 400, 'reader', None)
def test_get_devtable(self): def test_get_devtable(self):
self._run_test('GET', 200, 'devtable', None) self._run_test('GET', 400, 'devtable', None)
def test_post_anonymous(self): def test_post_anonymous(self):
self._run_test('POST', 400, None, {u'visibility': u'public', u'repository': 'XZGB', self._run_test('POST', 400, None, {u'visibility': u'public', u'repository': 'XZGB',

6
test/test_api_usage.py
View file

@ -1331,14 +1331,14 @@ class TestListRepos(ApiTestCase):
self.assertEquals(len(json['repositories']), 1) self.assertEquals(len(json['repositories']), 1)
def test_listrepos_orgmember(self): def test_listrepos_asorgmember(self):
self.login(READ_ACCESS_USER) self.login(READ_ACCESS_USER)
# Queries: Base + the list query # Queries: Base + the list query
with assert_query_count(BASE_LOGGEDIN_QUERY_COUNT + 1): with assert_query_count(BASE_LOGGEDIN_QUERY_COUNT + 1):
json = self.getJsonResponse(RepositoryList, params=dict(public=True)) json = self.getJsonResponse(RepositoryList, params=dict(public=True))
self.assertGreater(len(json['repositories']), 1) self.assertGreater(len(json['repositories']), 0)
def test_listrepos_filter(self): def test_listrepos_filter(self):
self.login(READ_ACCESS_USER) self.login(READ_ACCESS_USER)
@ -1353,7 +1353,7 @@ class TestListRepos(ApiTestCase):
def test_listrepos_limit(self): def test_listrepos_limit(self):
self.login(READ_ACCESS_USER) self.login(READ_ACCESS_USER)
json = self.getJsonResponse(RepositoryList, params=dict(limit=1)) json = self.getJsonResponse(RepositoryList, params=dict(limit=1, public=True))
self.assertEquals(len(json['repositories']), 1) self.assertEquals(len(json['repositories']), 1)
def test_listrepos_allparams(self): def test_listrepos_allparams(self):