Prevent internal server error when receiving a JSON request body with non-object top-level structure (#9)

Prevent internal server error when receiving a JSON request body with non-object top-level structure
This commit is contained in:
Daan de Ruiter
2021-03-05 21:46:13 +01:00
committed by GitHub
parent c6b979dcaf
commit 81d4e93a1d
3 changed files with 75 additions and 3 deletions

View File

@@ -1,5 +1,5 @@
from .view import PydanticView
__version__ = "1.7.2"
__version__ = "1.8.0"
__all__ = ("PydanticView", "__version__")

View File

@@ -61,6 +61,7 @@ class BodyGetter(AbstractInjector):
def __init__(self, args_spec: dict, default_values: dict):
self.arg_name, self.model = next(iter(args_spec.items()))
self._expect_object = self.model.schema()["type"] == "object"
async def inject(self, request: BaseRequest, args_view: list, kwargs_view: dict):
try:
@@ -70,7 +71,16 @@ class BodyGetter(AbstractInjector):
text='{"error": "Malformed JSON"}', content_type="application/json"
) from None
kwargs_view[self.arg_name] = self.model(**body)
# Pydantic tries to cast certain structures, such as a list of 2-tuples,
# to a dict. Prevent this by requiring the body to be a dict for object models.
if self._expect_object and not isinstance(body, dict):
raise HTTPBadRequest(
text='[{"in": "body", "loc": ["__root__"], "msg": "value is not a '
'valid dict", "type": "type_error.dict"}]',
content_type="application/json",
) from None
kwargs_view[self.arg_name] = self.model.parse_obj(body)
class QueryGetter(AbstractInjector):