learningequality / learningequality/morango
Do stricter check using regex to validate hex UUID value
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15
- Forks
- 23
- PR merge metrics
- No merged PRs in 30d
Description
ValueError: invalid literal for int() with base 16: '//..//..//..//../WEBINF/web.xml\x00'
Sentry Issue: KOLIBRI-BACKEND-2D5
ValueError: invalid literal for int() with base 16: '//..//..//..//../WEBINF/web.xml\x00'
(19 additional frame(s) were not displayed)
...
File "django/db/models/lookups.py", line 170, in as_sql
rhs_sql, rhs_params = self.process_rhs(compiler, connection)
File "django/db/models/lookups.py", line 103, in process_rhs
return self.get_db_prep_lookup(value, connection)
File "django/db/models/lookups.py", line 196, in get_db_prep_lookup
[get_db_prep_value(value, connection, prepared=True)]
File "morango/models/fields/uuids.py", line 39, in get_db_prep_value
value = uuid.UUID(value)
File "uuid.py", line 178, in __init__
int = int_(hex, 16)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in morango/models/fields/uuids.py at get_db_prep_value, where the traceback shows the value is converted with uuid.UUID. Review the existing conversion and add the requested regex-based hexadecimal UUID validation so malformed values such as the reported path are rejected before conversion; done means the invalid input no longer reaches the failing conversion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- backend, database
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100