Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update endpoint gives improper error message #55

Closed
mjrb opened this issue Feb 20, 2019 · 2 comments
Closed

update endpoint gives improper error message #55

mjrb opened this issue Feb 20, 2019 · 2 comments

Comments

@mjrb
Copy link
Member

mjrb commented Feb 20, 2019

in some cases the body's status code will disagree with the actual responses status code. for example if the update is malformed. also when testing if a hacker can check themselves into an event the error format completely changes (potentially it is getting handled by pymongo). There was no status code in the body and the response code was 200. the body was {errorMessage: '$set' is empty. You must specify a field like so: {$set: {<field>: ...}}, errorType: WriteError, stackTrace: [[/var/task/schemas.py, 17, wrapt, return config.add_cors_headers(fn(event, context, *extras))], [/var/task/schemas.py, 46, wrapt, return fn(event, context, results, *args)], [/var/task/validate.py, 246, update, tests.update_one({'email': event['user_email']}, updates)], [/var/task/pymongo/collection.py, 975, update_one, session=session),], [/var/task/pymongo/collection.py, 835, _update_retryable, _update, session)], [/var/task/pymongo/mongo_client.py, 1099, _retryable_write, return self._retry_with_session(retryable, func, s, None)], [/var/task/pymongo/mongo_client.py, 1076, _retry_with_session, return func(session, sock_info, retryable)], [/var/task/pymongo/collection.py, 831, _update, retryable_write=retryable_write)], [/var/task/pymongo/collection.py, 797, _update, _check_write_command_response(result)], [/var/task/pymongo/helpers.py, 208, _check_write_command_response, _raise_last_write_error(write_errors)], [/var/task/pymongo/helpers.py, 190, _raise_last_write_error, raise WriteError(error.get("errmsg"), error.get("code"), error)]]}
this may have been caused by realizing a hacker shouldn't be able to check them self in for an event and deleteing that update, thus leaving an empty update object.

@hemangandhi
Copy link
Member

Subsumed by #30

@hemangandhi
Copy link
Member

That is exactly the issue.

For easier dev, the validator just throws out invalid changes, but really, it should just return some sort of partial result indicating that some of the updates were invalid.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants