Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check forbidden chars for ids/attr names in URIs #1795

Merged
merged 4 commits into from
Feb 15, 2016
Merged

Check forbidden chars for ids/attr names in URIs #1795

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cd4edb2
Check forbidden chars for ids/attr names in URIs
crbrox Feb 15, 2016
eb6b6a5
Fix spelling CNR
crbrox Feb 15, 2016
c2969ee
Fix CNR
crbrox Feb 15, 2016
e01a7cf
Fix test case
crbrox Feb 15, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGES_NEXT_RELEASE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,4 @@
- Add: support for geo:point type as a way of specifying location attribute in NGSIv2 (Issue #1038)
- Add: type param for PUT entity in v2 (Issue #988, #992, #1000)
- Fix: not detecting forbidden chars in entityID for PATCH v2 (Issue #1782)

- Add: detect forbidden chars in ids and atrr names in URI (Issue #1793)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

type: atrr => attr

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ids -> entity ids (to distinguish among other possible ids, e.g. subscription ids)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed c2969ee

2 changes: 1 addition & 1 deletion src/lib/common/errorMessages.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,6 @@
*/

#define MORE_MATCHING_ENT "More than one matching entity. Please refine your query"

#define INVAL_CHAR_URI "invalid character in URI"

#endif // SRC_LIB_COMMON_ERRORMESSAGES_H
9 changes: 9 additions & 0 deletions src/lib/serviceRoutinesV2/deleteEntity.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@

#include "common/statistics.h"
#include "common/clockFunctions.h"
#include "common/errorMessages.h"

#include "rest/ConnectionInfo.h"
#include "ngsi/ParseData.h"
Expand All @@ -36,6 +37,8 @@
#include "apiTypesV2/ErrorCode.h"
#include "serviceRoutinesV2/deleteEntity.h"
#include "serviceRoutines/postUpdateContext.h"
#include "parse/forbiddenChars.h"



/* ****************************************************************************
Expand Down Expand Up @@ -68,6 +71,12 @@ std::string deleteEntity
eP->id = compV[2];
eP->type = ciP->uriParam["type"];

if (forbiddenIdChars(ciP->apiVersion, compV[2].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

if (compV.size() == 5) // Deleting an attribute
{
ContextAttribute *ca = new ContextAttribute;
Expand Down
10 changes: 9 additions & 1 deletion src/lib/serviceRoutinesV2/getEntity.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,14 +28,16 @@
#include "common/statistics.h"
#include "common/clockFunctions.h"
#include "common/string.h"
#include "common/errorMessages.h"

#include "rest/ConnectionInfo.h"
#include "ngsi/ParseData.h"
#include "apiTypesV2/Entities.h"
#include "rest/EntityTypeInfo.h"
#include "serviceRoutinesV2/getEntities.h"
#include "serviceRoutines/postQueryContext.h"

#include "rest/OrionError.h"
#include "parse/forbiddenChars.h"


/* ****************************************************************************
Expand Down Expand Up @@ -64,6 +66,12 @@ std::string getEntity
std::string attrs = ciP->uriParam["attrs"];
std::string type = ciP->uriParam["type"];

if (forbiddenIdChars(ciP->apiVersion, compV[2].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

// Fill in QueryContextRequest
parseDataP->qcr.res.fill(compV[2], type, "false", EntityTypeEmptyOrNotEmpty, "");

Expand Down
16 changes: 14 additions & 2 deletions src/lib/serviceRoutinesV2/getEntityAttribute.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,15 +27,16 @@

#include "common/statistics.h"
#include "common/clockFunctions.h"
#include "common/errorMessages.h"

#include "apiTypesV2/Attribute.h"
#include "rest/ConnectionInfo.h"
#include "ngsi/ParseData.h"
#include "rest/EntityTypeInfo.h"
#include "serviceRoutines/postQueryContext.h"
#include "serviceRoutinesV2/getEntityAttribute.h"


#include "parse/forbiddenChars.h"
#include "rest/OrionError.h"

/* ****************************************************************************
*
Expand Down Expand Up @@ -64,6 +65,17 @@ std::string getEntityAttribute
std::string answer;
Attribute attribute;

if (forbiddenIdChars(ciP->apiVersion, compV[2].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

if (forbiddenIdChars(ciP->apiVersion, compV[4].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

// 01. Fill in QueryContextRequest
parseDataP->qcr.res.fill(compV[2], type, "false", EntityTypeEmptyOrNotEmpty, "");
Expand Down
14 changes: 14 additions & 0 deletions src/lib/serviceRoutinesV2/getEntityAttributeValue.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,8 @@
#include "rest/EntityTypeInfo.h"
#include "serviceRoutines/postQueryContext.h"
#include "serviceRoutinesV2/getEntityAttribute.h"
#include "parse/forbiddenChars.h"
#include "rest/OrionError.h"



Expand Down Expand Up @@ -65,6 +67,18 @@ std::string getEntityAttributeValue
std::string type = ciP->uriParam["type"];
bool text = (ciP->uriParamOptions["options"] == true || ciP->outFormat == TEXT);

if (forbiddenIdChars(ciP->apiVersion, compV[2].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

if (forbiddenIdChars(ciP->apiVersion, compV[4].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

// Fill in QueryContextRequest
parseDataP->qcr.res.fill(compV[2], type, "false", EntityTypeEmptyOrNotEmpty, "");

Expand Down
9 changes: 8 additions & 1 deletion src/lib/serviceRoutinesV2/postEntity.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@

#include "common/statistics.h"
#include "common/clockFunctions.h"
#include "common/errorMessages.h"

#include "apiTypesV2/Entities.h"
#include "ngsi/ParseData.h"
Expand All @@ -38,7 +39,7 @@
#include "rest/OrionError.h"
#include "serviceRoutinesV2/postEntity.h"
#include "serviceRoutines/postUpdateContext.h"

#include "parse/forbiddenChars.h"


/* ****************************************************************************
Expand Down Expand Up @@ -67,6 +68,12 @@ std::string postEntity
eP->id = compV[2];
eP->type = ciP->uriParam["type"];

if (forbiddenIdChars(ciP->apiVersion, compV[2].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

if (ciP->uriParamOptions["append"] == true) // pure-append
{
op = "APPEND_STRICT";
Expand Down
8 changes: 7 additions & 1 deletion src/lib/serviceRoutinesV2/putEntity.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
#include "serviceRoutinesV2/putEntity.h"
#include "serviceRoutines/postUpdateContext.h"
#include "rest/OrionError.h"

#include "parse/forbiddenChars.h"


/* ****************************************************************************
Expand Down Expand Up @@ -71,6 +71,12 @@ std::string putEntity
eP->id = compV[2];
eP->type = ciP->uriParam["type"];

if (forbiddenIdChars(ciP->apiVersion, compV[2].c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

// 01. Fill in UpdateContextRequest
parseDataP->upcr.res.fill(eP, "REPLACE");

Expand Down
14 changes: 14 additions & 0 deletions src/lib/serviceRoutinesV2/putEntityAttribute.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,13 +27,15 @@

#include "common/statistics.h"
#include "common/clockFunctions.h"
#include "common/errorMessages.h"

#include "rest/ConnectionInfo.h"
#include "ngsi/ParseData.h"
#include "rest/EntityTypeInfo.h"
#include "serviceRoutines/postUpdateContext.h"
#include "serviceRoutinesV2/putEntityAttribute.h"
#include "rest/OrionError.h"
#include "parse/forbiddenChars.h"



Expand Down Expand Up @@ -66,6 +68,18 @@ std::string putEntityAttribute
std::string attributeName = compV[4];
std::string type = ciP->uriParam["type"];

if (forbiddenIdChars(ciP->apiVersion, entityId.c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

if (forbiddenIdChars(ciP->apiVersion, attributeName.c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

// 01. Fill in UpdateContextRequest from URL and payload
parseDataP->attr.attribute.name = attributeName;

Expand Down
14 changes: 13 additions & 1 deletion src/lib/serviceRoutinesV2/putEntityAttributeValue.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@
#include "rest/EntityTypeInfo.h"
#include "serviceRoutines/postUpdateContext.h"
#include "serviceRoutinesV2/putEntityAttributeValue.h"

#include "rest/OrionError.h"
#include "parse/forbiddenChars.h"


/* ****************************************************************************
Expand Down Expand Up @@ -64,6 +65,17 @@ std::string putEntityAttributeValue
std::string attributeName = compV[4];
std::string type = ciP->uriParam["type"];

if (forbiddenIdChars(ciP->apiVersion, entityId.c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

if (forbiddenIdChars(ciP->apiVersion, attributeName.c_str() , NULL))
{
OrionError oe(SccBadRequest, INVAL_CHAR_URI);
return oe.render(ciP, "");
}

// 01. Fill in UpdateContextRequest with data from URI and payload
parseDataP->av.attribute.name = attributeName;
Expand Down
Loading