You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by ja...@apache.org on 2022/09/01 20:46:57 UTC
[couchdb] branch session-require-content-type created (now b68f6310b)
This is an automated email from the ASF dual-hosted git repository.
jaydoane pushed a change to branch session-require-content-type
in repository https://gitbox.apache.org/repos/asf/couchdb.git
at b68f6310b Maybe return bad_content_type on _session POST
This branch includes the following new commits:
new 08e62bb59 Fix 'Bound variable in pattern' warnings
new b68f6310b Maybe return bad_content_type on _session POST
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[couchdb] 02/02: Maybe return bad_content_type on _session POST
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jaydoane pushed a commit to branch session-require-content-type
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit b68f6310b50cb15225358016fee91832b533a964
Author: Jay Doane <ja...@apache.org>
AuthorDate: Thu Sep 1 13:38:44 2022 -0700
Maybe return bad_content_type on _session POST
Currently, when POSTing to `/_session` with a Content-Type header
other than either `application/x-www-form-urlencoded` or
`application/json`, the error response can be surprising.
This changes the response to 415 `bad_content_type` when it's not one
of the above.
---
src/couch/src/couch_httpd_auth.erl | 5 ++++-
src/couch/test/eunit/couchdb_auth_tests.erl | 15 +++++++++++++++
2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/couch/src/couch_httpd_auth.erl b/src/couch/src/couch_httpd_auth.erl
index cc02a1e9d..4412222be 100644
--- a/src/couch/src/couch_httpd_auth.erl
+++ b/src/couch/src/couch_httpd_auth.erl
@@ -459,7 +459,10 @@ handle_session_req(#httpd{method = 'POST', mochi_req = MochiReq} = Req, AuthModu
Pairs
);
_ ->
- []
+ throw({bad_ctype, <<"Content-Type must be "
+ "'application/x-www-form-urlencoded' or "
+ "'application/json'">>}
+ )
end,
UserName = ?l2b(extract_username(Form)),
Password = ?l2b(couch_util:get_value("password", Form, "")),
diff --git a/src/couch/test/eunit/couchdb_auth_tests.erl b/src/couch/test/eunit/couchdb_auth_tests.erl
index dfb22dc25..ba652a059 100644
--- a/src/couch/test/eunit/couchdb_auth_tests.erl
+++ b/src/couch/test/eunit/couchdb_auth_tests.erl
@@ -34,6 +34,7 @@ auth_test_() ->
Tests = [
fun should_return_username_on_post_to_session/2,
fun should_not_return_authenticated_field/2,
+ fun should_return_bad_content_type_appropriately/2,
fun should_return_list_of_handlers/2
],
RequireValidUserTests = [
@@ -85,6 +86,20 @@ should_return_username_on_post_to_session(_PortType, Url) ->
end
).
+should_return_bad_content_type_appropriately(_PortType, Url) ->
+ ?_assertEqual(
+ <<"bad_content_type">>,
+ begin
+ {ok, 415, _, Body} = test_request:post(
+ Url,
+ [{"Content-Type", ""}],
+ []
+ ),
+ #{<<"error">> := Error} = jiffy:decode(Body, [return_maps]),
+ Error
+ end
+ ).
+
should_not_return_authenticated_field(_PortType, Url) ->
?_assertThrow(
{not_found, _},
[couchdb] 01/02: Fix 'Bound variable in pattern' warnings
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jaydoane pushed a commit to branch session-require-content-type
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit 08e62bb59131d86e3ee28e5a7692bf819596cb21
Author: Jay Doane <ja...@apache.org>
AuthorDate: Thu Sep 1 11:52:48 2022 -0700
Fix 'Bound variable in pattern' warnings
---
src/couch/src/couch_httpd_auth.erl | 2 +-
src/couch/src/couch_util.erl | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/couch/src/couch_httpd_auth.erl b/src/couch/src/couch_httpd_auth.erl
index cdb790f57..cc02a1e9d 100644
--- a/src/couch/src/couch_httpd_auth.erl
+++ b/src/couch/src/couch_httpd_auth.erl
@@ -574,7 +574,7 @@ extract_username(Form) ->
case couch_util:get_value("username", Form, CouchFormat) of
undefined ->
throw({bad_request, <<"request body must contain a username">>});
- CouchFormat ->
+ Format when Format =:= CouchFormat ->
CouchFormat;
Else1 when CouchFormat == undefined ->
Else1;
diff --git a/src/couch/src/couch_util.erl b/src/couch/src/couch_util.erl
index e916bbc69..afce1e0a5 100644
--- a/src/couch/src/couch_util.erl
+++ b/src/couch/src/couch_util.erl
@@ -256,7 +256,7 @@ get_value(Key, List) ->
get_value(Key, List, Default) ->
case lists:keysearch(Key, 1, List) of
- {value, {Key, Value}} ->
+ {value, {K, Value}} when K =:= Key ->
Value;
false ->
Default