learningequality / learningequality/morango

Do stricter check using regex to validate hex UUID value

Open
#178 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
15
Forks
23
PR merge metrics
No merged PRs in 30d

Description

ValueError: invalid literal for int() with base 16: '//..//..//..//../WEBINF/web.xml\x00'

Sentry Issue: KOLIBRI-BACKEND-2D5

ValueError: invalid literal for int() with base 16: '//..//..//..//../WEBINF/web.xml\x00'
(19 additional frame(s) were not displayed)
...
  File "django/db/models/lookups.py", line 170, in as_sql
    rhs_sql, rhs_params = self.process_rhs(compiler, connection)
  File "django/db/models/lookups.py", line 103, in process_rhs
    return self.get_db_prep_lookup(value, connection)
  File "django/db/models/lookups.py", line 196, in get_db_prep_lookup
    [get_db_prep_value(value, connection, prepared=True)]
  File "morango/models/fields/uuids.py", line 39, in get_db_prep_value
    value = uuid.UUID(value)
  File "uuid.py", line 178, in __init__
    int = int_(hex, 16)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in morango/models/fields/uuids.py at get_db_prep_value, where the traceback shows the value is converted with uuid.UUID. Review the existing conversion and add the requested regex-based hexadecimal UUID validation so malformed values such as the reported path are rejected before conversion; done means the invalid input no longer reaches the failing conversion.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
backend, database
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.