ocket8888 commented on code in PR #7079:
URL: https://github.com/apache/trafficcontrol/pull/7079#discussion_r992828648
##########
traffic_ops/traffic_ops_golang/server/servers_server_capability.go:
##########
@@ -453,77 +443,178 @@ func AssignMultipleServerCapabilities(w
http.ResponseWriter, r *http.Request) {
}
defer inf.Close()
- var msc tc.MultipleServerCapabilities
- if err := json.NewDecoder(r.Body).Decode(&msc); err != nil {
- api.HandleErr(w, r, tx, http.StatusBadRequest, err, nil)
+ var mssc tc.MultipleServersCapabilities
+ if err := json.NewDecoder(r.Body).Decode(&mssc); err != nil {
+ api.HandleErr(w, r, tx, http.StatusBadRequest,
fmt.Errorf("error decoding POST request body into MultipleServersCapabilities
struct %w", err), nil)
return
}
- // Check existence prior to checking type
- _, exists, err := dbhelpers.GetServerNameFromID(tx, int64(msc.ServerID))
- if err != nil {
- api.HandleErr(w, r, tx, http.StatusInternalServerError, nil,
err)
- }
- if !exists {
- userErr := fmt.Errorf("server %d does not exist", msc.ServerID)
- api.HandleErr(w, r, tx, http.StatusNotFound, userErr, nil)
- return
+ if len(mssc.ServerIDs) >= 1 {
+ errCode, userErr, sysErr = checkExistingServer(tx,
mssc.ServerIDs, inf.User.UserName)
+ if userErr != nil || sysErr != nil {
+ api.HandleErr(w, r, inf.Tx.Tx, errCode, userErr, sysErr)
+ return
+ }
}
// Ensure type is correct
- correctType := true
- if err := tx.QueryRow(scCheckServerTypeQuery(),
msc.ServerID).Scan(&correctType); err != nil {
- api.HandleErr(w, r, tx, http.StatusInternalServerError, nil,
fmt.Errorf("checking server type: %w", err))
+ errCode, userErr, sysErr = checkServerType(tx, mssc.ServerIDs)
+ if userErr != nil || sysErr != nil {
+ api.HandleErr(w, r, inf.Tx.Tx, errCode, userErr, sysErr)
return
}
- if !correctType {
- userErr := fmt.Errorf("server %d has an incorrect server type.
Server capabilities can only be assigned to EDGE or MID servers", msc.ServerID)
- api.HandleErr(w, r, tx, http.StatusBadRequest, userErr, nil)
- return
+
+ // Insert rows in DB
+ sid := make([]int64, len(mssc.ServerCapabilities))
+ scs := make([]string, len(mssc.ServerIDs))
+ if len(mssc.ServerIDs) == 1 {
+ if len(mssc.ServerCapabilities) >= 1 {
+ for i := range mssc.ServerCapabilities {
+ sid[i] = mssc.ServerIDs[0]
+ }
+ scs = mssc.ServerCapabilities
+ }
+ } else if len(mssc.ServerCapabilities) == 1 {
+ if len(mssc.ServerIDs) >= 1 {
+ for i := range mssc.ServerIDs {
+ scs[i] = mssc.ServerCapabilities[0]
+ }
+ sid = mssc.ServerIDs
+ }
+ } else {
+ scs = mssc.ServerCapabilities
+ sid = mssc.ServerIDs
}
- cdnName, err := dbhelpers.GetCDNNameFromServerID(tx,
int64(msc.ServerID))
+ msscQuery := `INSERT INTO server_server_capability
+ select "server_capability", "server"
+ FROM UNNEST($1::text[], $2::int[]) AS
tmp("server_capability", "server")`
+ _, err := tx.Query(msscQuery, pq.Array(scs), pq.Array(sid))
if err != nil {
- api.HandleErr(w, r, tx, http.StatusInternalServerError, nil,
err)
+ useErr, sysErr, statusCode := api.ParseDBError(err)
+ api.HandleErr(w, r, tx, statusCode, useErr, sysErr)
return
}
- userErr, sysErr, errCode = dbhelpers.CheckIfCurrentUserCanModifyCDN(tx,
string(cdnName), inf.User.UserName)
+ var alerts tc.Alerts
+ if mssc.PageType == "sc" {
+ alerts = tc.CreateAlerts(tc.SuccessLevel, "Assign Server(s) to
a capability")
+ } else {
+ alerts = tc.CreateAlerts(tc.SuccessLevel, "Assign Server
Capability(ies) to a server")
+ }
+ api.WriteAlertsObj(w, r, http.StatusOK, alerts, mssc)
+ return
+}
+
+// DeleteMultipleServersCapabilities deletes multiple servers to a capability
or multiple server capabilities to a server
+func DeleteMultipleServersCapabilities(w http.ResponseWriter, r *http.Request)
{
+ inf, userErr, sysErr, errCode := api.NewInfo(r, nil, nil)
+ tx := inf.Tx.Tx
if userErr != nil || sysErr != nil {
- api.HandleErr(w, r, tx, errCode, userErr, sysErr)
+ api.HandleErr(w, r, inf.Tx.Tx, errCode, userErr, sysErr)
return
}
+ defer inf.Close()
- //Delete existing rows from server_server_capability for a given server
- _, err = tx.Exec("DELETE FROM server_server_capability ssc WHERE
ssc.server=$1", msc.ServerID)
- if err != nil {
- useErr, sysErr, statusCode := api.ParseDBError(err)
- api.HandleErr(w, r, tx, statusCode, useErr, sysErr)
+ var mssc tc.MultipleServersCapabilities
+ if err := json.NewDecoder(r.Body).Decode(&mssc); err != nil {
+ api.HandleErr(w, r, tx, http.StatusBadRequest,
fmt.Errorf("error decoding DELETE request body into MultipleServersCapabilities
struct %w", err), nil)
return
}
- multipleServerCapabilities := make([]string, 0,
len(msc.ServerCapabilities))
+ if len(mssc.ServerIDs) >= 1 {
+ errCode, userErr, sysErr = checkExistingServer(tx,
mssc.ServerIDs, inf.User.UserName)
+ if userErr != nil || sysErr != nil {
+ api.HandleErr(w, r, inf.Tx.Tx, errCode, userErr, sysErr)
+ return
+ }
+ }
- mscQuery := `WITH inserted AS (
- INSERT INTO server_server_capability
- SELECT "server_capability", $2
- FROM UNNEST($1::text[]) AS tmp("server_capability")
- RETURNING server_capability
- )
- SELECT ARRAY_AGG(server_capability)
- FROM (
- SELECT server_capability
- FROM inserted
- ) AS returned(server_capability)`
+ //Delete existing rows from server_server_capability for a given server
or for a given capability
+ const delQuery = `DELETE FROM server_server_capability ssc WHERE `
+ var dq string
+ var alerts tc.Alerts
+ if mssc.PageType == "sc" {
+ dq = delQuery + fmt.Sprintf("ssc.server_capability='%v'",
mssc.ServerCapabilities[0])
+ if len(mssc.ServerIDs) == 1 {
+ dq = dq + fmt.Sprintf(" AND ssc.server=%v",
mssc.ServerIDs[0])
+ }
+ } else {
+ dq = delQuery + fmt.Sprintf("ssc.server=%v", mssc.ServerIDs[0])
+ if len(mssc.ServerCapabilities) == 1 {
+ dq = dq + fmt.Sprintf(" AND
ssc.server_capability='%v'", mssc.ServerCapabilities[0])
Review Comment:
Actually, just wanted to point out something that CodeQL found, since
Srijeet hasn't mentioned it.
You should never ever ever use `fmt.Sprintf` to build queries from user data
like this. You MUST use prepared database statements. The way this is right
now, I can submit a request like:
```json
{"serverIds": [2], "serverCapabilities": ["test'; DROP TABLE tm_user
CASCADE; --"]}
```
(to DELETE /api/4.1/multiple_servers_capabilities)
and I'll get a response like
```json
{
"response": {
"serverCapabilities": [
"test'; DROP TABLE tm_user CASCADE; --"
],
"serverIds": [
2
],
"pageType": ""
}
}
```
... and it has now dropped the users, changelogs, and Delivery Service
Request tables from the database. All data lost, API rendered completely
unusable because nobody can log in as any user.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
