(couchdb) 01/01: Prevent inserting illegal ddocs via mango

[va...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

vatamane pushed a commit to branch validate-mango-ddocs
in repository https://gitbox.apache.org/repos/asf/couchdb.git

commit fd45447f0e67ac5c144078562de108b2335393e1
Author: Nick Vatamaniuc <va...@gmail.com>
AuthorDate: Thu Oct 31 15:54:06 2024 -0400

    Prevent inserting illegal ddocs via mango
    
    Mango indexes allow specifying a custom ddoc ID in the `_index` POST request.
    Previously it was possible to insert `_design/` which is an illegal doc ID.
---
 src/mango/src/mango_httpd.erl        | 1 +
 src/mango/test/01-index-crud-test.py | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/mango/src/mango_httpd.erl b/src/mango/src/mango_httpd.erl
index 8e4b72840..9bde45e1a 100644
--- a/src/mango/src/mango_httpd.erl
+++ b/src/mango/src/mango_httpd.erl
@@ -87,6 +87,7 @@ handle_index_req(#httpd{method = 'POST', path_parts = [_, _]} = Req, Db) ->
     {ok, DDoc} = mango_util:load_ddoc(Db, mango_idx:ddoc(Idx), DbOpts),
     Id = Idx#idx.ddoc,
     Name = Idx#idx.name,
+    ok = couch_doc:validate_docid(DDoc#doc.id, couch_db:name(Db)),
     Status =
         case mango_idx:add(DDoc, Idx) of
             {ok, DDoc} ->
diff --git a/src/mango/test/01-index-crud-test.py b/src/mango/test/01-index-crud-test.py
index 24409b49a..4de777799 100644
--- a/src/mango/test/01-index-crud-test.py
+++ b/src/mango/test/01-index-crud-test.py
@@ -80,7 +80,7 @@ class IndexCrudTests(mango.DbPerClass):
                 raise AssertionError("bad create index")
 
     def test_bad_ddocs(self):
-        bad_ddocs = ["", True, False, 1.5, {"foo": "bar"}, [None, False]]
+        bad_ddocs = ["", "_design/", True, False, 1.5, {"foo": "bar"}, [None, False]]
         for bd in bad_ddocs:
             try:
                 self.db.create_index(["foo"], ddoc=bd)