Commit b0132db8 authored by Mickaël Desfrênes's avatar Mickaël Desfrênes
Browse files

do not allow negative offsets

parent cbfbfb73

src/rpc/methods.py

+2 −2
Original line number Diff line number Diff line
@@ -150,9 +150,9 @@ def _validate_limits(limit_from: int, limit_to: int) -> Tuple[int, int]: 
    try:

        limit_from = int(limit_from)

        limit_to = int(limit_to)

        if limit_to < limit_from:

        if limit_from < 0 or limit_to < 0 or limit_to < limit_from:

            raise ServiceException(WRONG_ARGUMENT)

    except ValueError:

    except (TypeError, ValueError):

        raise ServiceException(WRONG_ARGUMENT)

    return limit_from, limit_to

src/rpc/tests.py

+15 −0
Original line number Diff line number Diff line
@@ -112,6 +112,21 @@ class ServiceTestCase(TestCase): 
            methods.ping(self.test_user), "pong {}".format(self.test_user.username)

        )



    def test_validate_limits_rejects_negative_bounds(self):

        for limit_from, limit_to in ((-1, 10), (0, -1), (-2, -1)):

            with self.subTest(limit_from=limit_from, limit_to=limit_to):

                with self.assertRaises(ServiceException):

                    methods._validate_limits(limit_from, limit_to)



        self.assertEqual(methods._validate_limits(0, 0), (0, 0))



        with self.assertRaises(ServiceException):

            methods.collections(

                self.test_user,

                parent_id=self.test_project_root_collection.pk,

                limit_from=-1,

            )



    def test_client_configuration_returns_only_allowlisted_settings(self):

        configured_values = {

            "JAMA_RPC_MAX_BODY_SIZE": 101,