influxdata / influxdata/openapi
In /stacks inconsistent 'kind' value between GET and PATCH methods
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 18
- Forks
- 9
- PR merge metrics
- No merged PRs in 30d
Description
While working on Grace tests for stacks, I noticed that the `resources` defined for the GET method include a `kind` string property that is limited to an enumeration of acceptable strings. However in the PATCH method the `aditionalResources` property of `kind` is simply a string with no enumeration constraints. So it is possible to add a resource of type 'FOO' or a resource of type "NotificatoinEndpiont" (typos in enumerated type).
__Investigating with jq__
Stacks GET enforces an enumeration of TemplateKind
```bash
$ jq '.paths."/stacks".get.responses."200".content."application/json".schema.properties.stacks.items' cloud.json
{
"$ref": "#/components/schemas/Stack"
}
$ jq '.components.schemas.Stack.properties.events.items.properties.resources.items.properties.kind' cloud.json
{
"$ref": "#/components/schemas/TemplateKind"
}
$ jq '.components.schemas.TemplateKind' cloud.json
{
"type": "string",
"enum": [
"Bucket",
"Check",
"CheckDeadman",
"CheckThreshold",
"Dashboard",
"Label",
"NotificationEndpoint",
"NotificationEndpointHTTP",
"NotificationEndpointPagerDuty",
"NotificationEndpointSlack",
"NotificationRule",
"Task",
"Telegraf",
"Variable"
]
}
```
Stacks PATCH however does not have an enum and allows any string value
```bash
$ jq '.paths."/stacks/{stack_id}".patch.requestBody.content."application/json".schema.properties.additionalResources.items.properties.kind' cloud.json
{
"type": "string"
}
```
So the following is possible after PATCH, with no error thrown
```json
"resources": [
...
{
"apiVersion": "influxdata.com/v2alpha1",
"resourceID": "0969493978387000",
"kind": "Label",
"templateMetaName": "unbridled-bardeen-b87002",
"associations": [],
"links": {
"self": "/api/v2/labels/0969493978387000"
}
},
{
"apiVersion": "influxdata.com/v2alpha1",
"resourceID": "62e6b3f530226648",
"kind": "FOO",
"templateMetaName": "exciting-carver-b87000",
"associations": [],
"links": {
"self": "/api/v2/62e6b3f530226648"
}
}
],
```
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the OpenAPI schema shown in cloud.json and inspect the GET and PATCH paths for /stacks and /stacks/{stack_id}. Compare the resources.kind and additionalResources.kind definitions with TemplateKind. Done means PATCH rejects values outside the same allowed kind values as GET, with the relevant schema validation checked.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100