Request body parser should reject body with invalid elements

Bug #814518 reported by Salvatore Orlando
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
Fix Released
Low
Salvatore Orlando
quantum (Ubuntu)
Fix Released
Undecided
Unassigned
Nominated for Precise by Yolanda Robla

Bug Description

Currently the request body parser ignores invalid data in request body if a request body is not required.

The API should instead reject the request and return a 400 error.

Related branches

Changed in quantum:
assignee: nobody → Salvatore Orlando (salvatore-orlando)
Revision history for this message
dan wendlandt (danwent) wrote :

According to Salvatore, this is the last bug that needs to be fixed to get the existing unit tests running clean.

Salvatore, an you specify the unit test(s) do not pass because of this test? If so I can probably do a quick fix.

Also, what's your definition of "invalid data" here. Something that does not parse, or something that contains an unexpected parameter?

Revision history for this message
Salvatore Orlando (salvatore-orlando) wrote :

The tests that are failing are:
- create_port_badrequest_xml
- create_port_badrequest_json

They fail because the APIs return a 200 status code, while the test expects a 400 error.

The request body for the port create operation optionally contains the state for the port being created (ACTIVE or DOWN).
Therefore the API looks for it in the request body, and if it doesn't find it it just ignores the body.

This behaviour might be satisfying; however I think it would be even better if we return a 400 error when a body containing something different from the state of the port is sent to the API layer.

Changed in quantum:
importance: Undecided → Low
dan wendlandt (danwent)
Changed in quantum:
milestone: none → diablo-3
dan wendlandt (danwent)
Changed in quantum:
milestone: diablo-3 → diablo-4
Revision history for this message
dan wendlandt (danwent) wrote :

I took a closer look at this. It seems that the "create_network_badrequest" methods generates a 400 error and passes the unit test because the request lacks a required field ("net-name"), while the "create_port_badrequest" fails because a port has no required fields.

This led me to the conclusion that the existing API parsing logic does not seem to prevent there from being "extra" fields in the request that the API ignores, and adding such logic would be needed to get this test to pass. However, I'm not sure that is actually the right thing to do. I think this is part of a broader discussion about whether plugins should be able to use "data extension" or not. I will send mail to the list about that.

In the mean time, I would advocate for removing this test and deciding to re-insert it based on the decision we make regarding data extension.

Changed in quantum:
status: New → In Progress
Changed in quantum:
status: In Progress → Fix Committed
dan wendlandt (danwent)
Changed in quantum:
status: Fix Committed → Fix Released
Changed in quantum (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.