Payload content type is only partially validated if a payload isn't specified
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Barbican |
Fix Released
|
Medium
|
Juan Antonio Osorio Robles |
Bug Description
Currently, if a user only specifies a payload_
If a user specifies a payload_
Steps to Replicate:
curl -X POST -H "X-Auth-
"type": "key",
"meta": {
"mode": "cbc",
"bit_length": 256,
"name": "secretname",
"algorithm": "aes",
"payload_
}
}' http://
Actual Response:
200 OK
{
"order_ref": "http://
}
Expected Response:
400 Bad Request
{
"code": 400,
"description": "Provided object does not match schema 'Secret' within 'Order': payload_
"title": "Bad Request"
}
Changed in barbican: | |
status: | New → Confirmed |
Changed in barbican: | |
importance: | Undecided → Medium |
Changed in barbican: | |
assignee: | nobody → Juan Antonio Osorio Robles (juan-osorio-robles) |
Changed in barbican: | |
milestone: | none → kilo-2 |
Changed in barbican: | |
status: | Fix Committed → Fix Released |
Changed in barbican: | |
milestone: | kilo-2 → 2015.1.0 |
Hello John, per the API doc if the 'payload' is not specified, the 'payload_ content_ type' and 'payload_ content_ encoding' fields are ignored: https:/ /github. com/cloudkeep/ barbican/ wiki/Applicatio n-Programming- Interface# two-step- binary- secret- createretrieve
So I think this 'functions as designed', but perhaps the API should me modified to reject attempts to set those attributes if 'payload' is not specified? Worth bringing up at summit?