Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

submission: check length of file_location before creating new DataResource object #495

Open
GraemeWatt opened this issue Apr 19, 2022 · 0 comments
Labels
complexity: low priority: high type: bug Indicates an unexpected problem or unintended behaviour

Comments

@GraemeWatt
Copy link
Member

The DataResource object has a field file_location = db.Column(db.String(256)). The location of an additional resource is restricted to 256 characters by the JSON schema of the validator. However, the parse_additional_resources function prepends an additional string (e.g. basepath) to the location before creating a DataResource object. This means that the file_location can exceed 256 characters even if the validator has checked that the original location is less than 256 characters.

Similarly for the DataResource object created in the process_data_file function, where the file_location is obtained by prepending an additional string to the data_file field, although in this case the JSON schema of the validator does not have any maxLength restriction.

Since the validator does not know the length of the additional string to be prepended to the location or data_file fields specified in the submission.yaml file, this check probably needs to be made in the web application code rather than in the validator code or via the JSON schema.

@GraemeWatt GraemeWatt added type: bug Indicates an unexpected problem or unintended behaviour priority: high complexity: low labels Apr 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
complexity: low priority: high type: bug Indicates an unexpected problem or unintended behaviour
Projects
Status: To do
Development

No branches or pull requests

1 participant