Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: return bad request on DELETE body #1219

Merged
merged 6 commits into from
Feb 2, 2023
Merged

feat: return bad request on DELETE body #1219

merged 6 commits into from
Feb 2, 2023

Conversation

hperl
Copy link
Collaborator

@hperl hperl commented Jan 30, 2023 •
edited
Loading 

BREAKING CHANGES: This patch changes the behavior of the DELETE /relation-tuples API to reject requests with a 400 Bad Request that have:
* a request body (because no request body is consumed, so supplying a request body is interpreted as an error),
* extra query parameters (which might indicate mistyping a parameter), or
* no namespace specified (which would delete all tuples)

Related issue(s)

Checklist

  • I have read the contributing guidelines.
  • I have referenced an issue containing the design document if my change
    introduces a new feature.
  • I am following the
    contributing code guidelines.
  • I have read the security policy.
  • I confirm that this pull request does not address a security
    vulnerability. If this pull request addresses a security vulnerability, I
    confirm that I got the approval (please contact
    security@ory.sh) from the maintainers to push
    the changes.
  • I have added tests that prove my fix is effective or that my feature
    works.
  • I have added or changed the documentation.

Further Comments

@hperl
feat: return error on non-empty DELETE body
98720ee 
DELETE /admin/relation-tuples does not take a body, but users
of the API might confuse supplying query parameters with
supplying a body with a JSON document. Therefore, we will
return a bad request code 400 if any body was supplied to
DELETE.
@hperl hperl requested a review from zepatrik as a code owner January 30, 2023 16:09
@hperl hperl self-assigned this Jan 30, 2023
aeneasr
aeneasr requested changes Jan 30, 2023
View reviewed changes
Copy link
Member

@aeneasr aeneasr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My recommendation would be to restrict deleting all tuples in the manager - i.e. require at least one parameter to be set.

@hperl
feat: return error on extra query params on DELETE
4e774d1 
We now validate that no extra query params are sent to DELETE,
which protects against misspelling one of the query params.
@hperl hperl requested a review from aeneasr January 31, 2023 09:30
@hperl hperl requested a review from aeneasr February 1, 2023 15:42
@aeneasr aeneasr merged commit 195182c into master Feb 2, 2023
@aeneasr aeneasr deleted the hperl/delete-check-body branch February 2, 2023 22:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@zepatrik zepatrik Awaiting requested review from zepatrik zepatrik is a code owner

@aeneasr aeneasr Awaiting requested review from aeneasr

Assignees

@hperl hperl

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@hperl @aeneasr