You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Whilst I'm personally a fan of not restricting types further than needed, I've hit a rare issue where a user provided bad input and it got me wondering.
In essence, we have let's say the Get Manga endpoint under GET /manga/:id. Path traversal in URLs is a common pitfall and this is what happened. We got input of . for :id. This means instead we hit GET /manga which is a collection endpoint versus the expected entity endpoint.
My proposed solution to this would be using uuid.UUID() at the library level and accepting both types as arguments, e.g. input_: str | UUID and then transforming all string input to UUID transparently, which would resolve this issue.
Currently I'm wondering if this is a non-issue and shouldn't be handled by the library, rather than by the consumers. More investigation is needed.
The text was updated successfully, but these errors were encountered:
Whilst I'm personally a fan of not restricting types further than needed, I've hit a rare issue where a user provided bad input and it got me wondering.
In essence, we have let's say the Get Manga endpoint under
GET /manga/:id
. Path traversal in URLs is a common pitfall and this is what happened. We got input of.
for:id
. This means instead we hitGET /manga
which is a collection endpoint versus the expected entity endpoint.My proposed solution to this would be using
uuid.UUID()
at the library level and accepting both types as arguments, e.g.input_: str | UUID
and then transforming all string input to UUID transparently, which would resolve this issue.Currently I'm wondering if this is a non-issue and shouldn't be handled by the library, rather than by the consumers. More investigation is needed.
The text was updated successfully, but these errors were encountered: