[GitHub] ondra-novak opened a new issue #1479: _all_docs?key returns all documents when the value is not string.

[GitBox <gi...@apache.org>]

ondra-novak opened a new issue #1479: _all_docs?key returns all documents when the value is not string.
URL: https://github.com/apache/couchdb/issues/1479
 
 
   Searching _all_docs for specific document using "key", when the value is not string, it results to sending all documents (variable key is ignored). However, if the same value is put to the "keys" array, result is `not found` - which is correct.
   
   ## Expected Behavior
   ```
   $ curl -s http://localhost:5984/test/_all_docs?key=10 | wc -l
   3
   $ curl -s http://localhost:5984/test/_all_docs?keys=%5B10%5D | wc -l
   3
   ```
   ## Current Behavior
   (see steps to reproduce)
   ```
   $ curl -s http://localhost:5984/test/_all_docs?key=10 | wc -l
   102
   $ curl -s http://localhost:5984/test/_all_docs?keys=%5B10%5D | wc -l
   3
   ```
   ## Possible Solution
   Both responses should be same, because key and keys[] should be equivalent if one key is specified.
   
   ## Steps to Reproduce (for bugs)
   1. create database `test`
   2. load 100 documents
   3. `curl -s http://localhost:5984/test/_all_docs?key=10 | wc -l ` 
   4. `curl -s http://localhost:5984/test/_all_docs?keys=%5B10%5D | wc -l`
   
   Apparently the `_all_docs` handler ignores the variable 'key' if it contains non-string argument. This doesn't apply when variable keys is used and the non-string argument is put to the array.
   
   ## Context
   Search function on website with no input validation exposed a minor security issue. A user crafted a request with non-string input was able to receive all documents in the database. I am able to sanitise the input and resolve this security issue, but this should be also fixed on the database side - at least to achieve a consistency of the application interface
   
   ## Your Environment
   * Version used: 2.1.1
   * Browser Name and version: not related, couchdb is not directly connected with webserver
   * Operating System and version (desktop or mobile): Ubuntu 16.04 LTS
   * Link to your project: not public.
   

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services