serv/conduit
1
0
Fork 0
mirror of https://gitlab.com/famedly/conduit.git synced 2024-12-28 13:33:47 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Return proper error in case of invalid UTF-8 in json_body

Browse source 
json_body is used in places that need authentication. In
case an unknown field is set, Ruma doesn't parse the field
and so doesn't give an error on invalid UTF-8. But Conduit
has parsed and on error makes json_body None. Return an
error to the client instead of generating an internal error.
This commit is contained in:
Kurt Roeckx 2021-06-30 23:12:22 +02:00
parent cc9111059d
commit 699f77671f
3 changed files with 53 additions and 49 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

54
src/client_server/account.rs
View file

@ -157,15 +157,19 @@ pub async fn register_route(
} }
// Success! // Success!
} else { } else {
uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH)); if let Some(json) = body.json_body {
db.uiaa.create( uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH));
&UserId::parse_with_server_name("", db.globals.server_name()) db.uiaa.create(
.expect("we know this is valid"), &UserId::parse_with_server_name("", db.globals.server_name())
"".into(), .expect("we know this is valid"),
&uiaainfo, "".into(),
&body.json_body.expect("body is json"), &uiaainfo,
)?; &json,
return Err(Error::Uiaa(uiaainfo)); )?;
return Err(Error::Uiaa(uiaainfo));
} else {
return Err(Error::BadRequest(ErrorKind::NotJson, "Not json."));
}
} }
} }
@ -526,14 +530,14 @@ pub async fn change_password_route(
} }
// Success! // Success!
} else { } else {
uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH)); if let Some(json) = body.json_body {
db.uiaa.create( uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH));
&sender_user, db.uiaa
&sender_device, .create(&sender_user, &sender_device, &uiaainfo, &json)?;
&uiaainfo, return Err(Error::Uiaa(uiaainfo));
&body.json_body.expect("body is json"), } else {
)?; return Err(Error::BadRequest(ErrorKind::NotJson, "Not json."));
return Err(Error::Uiaa(uiaainfo)); }
} }
db.users db.users
@ -618,14 +622,14 @@ pub async fn deactivate_route(
} }
// Success! // Success!
} else { } else {
uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH)); if let Some(json) = body.json_body {
db.uiaa.create( uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH));
&sender_user, db.uiaa
&sender_device, .create(&sender_user, &sender_device, &uiaainfo, &json)?;
&uiaainfo, return Err(Error::Uiaa(uiaainfo));
&body.json_body.expect("body is json"), } else {
)?; return Err(Error::BadRequest(ErrorKind::NotJson, "Not json."));
return Err(Error::Uiaa(uiaainfo)); }
} }
// Leave all joined rooms and reject all invitations // Leave all joined rooms and reject all invitations

32
src/client_server/device.rs
View file

@ -116,14 +116,14 @@ pub async fn delete_device_route(
} }
// Success! // Success!
} else { } else {
uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH)); if let Some(json) = body.json_body {
db.uiaa.create( uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH));
&sender_user, db.uiaa
&sender_device, .create(&sender_user, &sender_device, &uiaainfo, &json)?;
&uiaainfo, return Err(Error::Uiaa(uiaainfo));
&body.json_body.expect("body is json"), } else {
)?; return Err(Error::BadRequest(ErrorKind::NotJson, "Not json."));
return Err(Error::Uiaa(uiaainfo)); }
} }
db.users.remove_device(&sender_user, &body.device_id)?; db.users.remove_device(&sender_user, &body.device_id)?;
@ -170,14 +170,14 @@ pub async fn delete_devices_route(
} }
// Success! // Success!
} else { } else {
uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH)); if let Some(json) = body.json_body {
db.uiaa.create( uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH));
&sender_user, db.uiaa
&sender_device, .create(&sender_user, &sender_device, &uiaainfo, &json)?;
&uiaainfo, return Err(Error::Uiaa(uiaainfo));
&body.json_body.expect("body is json"), } else {
)?; return Err(Error::BadRequest(ErrorKind::NotJson, "Not json."));
return Err(Error::Uiaa(uiaainfo)); }
} }
for device_id in &body.devices { for device_id in &body.devices {

16
src/client_server/keys.rs
View file

@ -145,14 +145,14 @@ pub async fn upload_signing_keys_route(
} }
// Success! // Success!
} else { } else {
uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH)); if let Some(json) = body.json_body {
db.uiaa.create( uiaainfo.session = Some(utils::random_string(SESSION_ID_LENGTH));
&sender_user, db.uiaa
&sender_device, .create(&sender_user, &sender_device, &uiaainfo, &json)?;
&uiaainfo, return Err(Error::Uiaa(uiaainfo));
&body.json_body.expect("body is json"), } else {
)?; return Err(Error::BadRequest(ErrorKind::NotJson, "Not json."));
return Err(Error::Uiaa(uiaainfo)); }
} }
if let Some(master_key) = &body.master_key { if let Some(master_key) = &body.master_key {