influxdata / influxdata/influxdb

NotificationEndpoint: http type does not check if URL string follows URL schema

Open
#23,724 2 comments 0 reactions 0 assignees View on GitHub
area/api kind/bug team/edge
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.

1. Prepare a new Notification Endpoint request
2. In the request body for the field `url` provide a string that does not follow the URL or URI schema from W3C https://www.w3.org/TR/2011/WD-html5-20110525/urls.html for example in Javascript I provided the value `Math.PI`
3. POST the request to /api/v2/notificationEndpoints

__Expected behavior:__
Describe what you expected to happen.

Expected the URL value to be verified and rejected, since the string does not fulfill the requirements to be a URL. At a minimum should match

```
URI = scheme ":" hier-part [ "?" query ] [ "#" fragment ]
```
https://www.rfc-editor.org/rfc/rfc3986

__Actual behavior:__
Describe What actually happened.
The request was accepted and the notficationEndpoint object was returned with the invalid URL

```
resp.body {
"id": "09f9ae7d8912a000",
"name": "SimpleHTTP_b4d89e",
"description": "3abc147aca56f91e68001803862a58a2e3b5406ce8e9426b9beee0552b37b12d",
"orgID": "45c6c63b15e97792",
"status": "active",
"createdAt": "2022-09-13T12:04:31.396425055Z",
"updatedAt": "2022-09-13T12:04:31.396425055Z",
"url": "3.141592653589793",
"token": "",
"username": "",
"password": "",
"authMethod": "none",
"method": "POST",
"contentTemplate": "",
"type": "http",
"labels": [],
"links": {
"self": "/api/v2/notificationEndpoints/09f9ae7d8912a000",
"labels": "/api/v2/notificationEndpoints/09f9ae7d8912a000/labels",
"members": "/api/v2/notificationEndpoints/09f9ae7d8912a000/members",
"owners": "/api/v2/notificationEndpoints/09f9ae7d8912a000/owners"
}
```
This was from posting the following request

```
{
"orgID": "45c6c63b15e97792",
"name": "SimpleHTTP_b4d89e",
"description": "3abc147aca56f91e68001803862a58a2e3b5406ce8e9426b9beee0552b37b12d",
"type": "http",
"status": "active",
"authMethod": "none",
"method": "POST",
"url": "3.141592653589793"
}
```

__Environment info:__

Testing against latest remocal K8S-IDPE

```
commit 7c046b8fee75b90bc2d7b176ffbe7e045b9c3fae (HEAD -> master, origin/master, origin/HEAD)
Author: influx-acs[bot] <107396960+influx-acs[bot]@users.noreply.github.com>
Date: Tue Sep 13 07:53:01 2022 +0000

```

Contributor guide

Open the contributing guide

Research direction

Start at the POST /api/v2/notificationEndpoints entry point and trace how the `url` field is handled for endpoints with `type` set to `http`. Reproduce the request using `3.141592653589793`, then add coverage showing that a value without a URI scheme is rejected and that valid URLs remain accepted.

Written by the indexing model from the issue text.

Assessment

Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.