<div dir="ltr"><br><div class="gmail_extra"><div class="gmail_quote">On Thu, Jun 6, 2013 at 2:23 PM, Brant Knudson <span dir="ltr"><<a href="mailto:blk@acm.org" target="_blank">blk@acm.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr"><div><div><br>Does OpenStack have a policy for handling of extra/unexpected arguments? Examples of extra arguments are unexpected query parameters on a GET request or extra fields provided in the JSON body of a POST.<br>
<br></div>Many web APIs ignore extra arguments to make it easier to add support for new features. For example, if 'GET /users' adds support for sorting with 'GET /users?sort=id' , new clients will still work with old servers, they just won't get the users back in sorted order.<br>
<br></div><div>If we strictly validate inputs that would make it more difficult to extend our APIs.</div></div></blockquote><div><br></div><div style>The current JSON schema validator ignores attributes that are not in the schema (i.e. it "allows any other attribute").</div>
<div style><br></div><div style> >>> import jsonschema<br></div><div style> >>> schema={'title': 'role', 'properties': {'id': {'type': 'string'}}, 'required': ['id']}</div>
<div style> >>> validator = jsonschema.validators.Draft4Validator(schema)<br></div><div style><div> >>> validator.validate({'id': 'abc123'}) # id is validated as a required string</div>
<div> >>> validator.validate({'id': 'abc123', 'name': 'foo'}) # name is not an attribute in the schema</div><div> >>> validator.validate({'id': 123, 'name': 'foo'}) # id is not a string</div>
<div> Traceback (most recent call last):</div><div> File "<stdin>", line 1, in <module></div><div> File "/Users/dolph/Environments/os/lib/python2.7/site-packages/jsonschema/validators.py", line 117, in validate</div>
<div> raise error</div><div> jsonschema.exceptions.ValidationError: 123 is not of type 'string'</div><div> <br></div><div> Failed validating 'type' in schema['properties']['id']:</div>
<div> {'type': 'string'}</div><div><br></div><div> On instance['id']:</div><div> 123</div></div><div><br></div><div>Support for explicitly enumerating disallowed attributes was in draft 3 but was removed in draft 4... not sure why.<br>
</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><span class=""><font color="#888888"><br>
</font></span></div><span class=""><font color="#888888"><div><br></div>- Brant<br><br></font></span></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div class="im">On Sun, Jun 2, 2013 at 4:11 AM, Bruno Semperlotti <span dir="ltr"><<a href="mailto:bruno.semperlotti@gmail.com" target="_blank">bruno.semperlotti@gmail.com</a>></span> wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div class="h5"><div dir="ltr"><div>Hi,</div><div>
<br></div><div>As a first contribution, I recently worked on a small bug about bad error response when passing incorrect parameters in API requests (<span style="color:rgb(102,102,102);font-family:Ubuntu,'Bitstream Vera Sans','DejaVu Sans',Tahoma,sans-serif;font-size:12px;line-height:18px"><a href="https://bugs.launchpad.net/keystone/+bug/1110435" target="_blank">#1110435</a></span>).</div>
<div>There is also this other bug about bad application behavior when API requests data are incorrect or missing (<a href="https://bugs.launchpad.net/keystone/+bug/999084" target="_blank">#999084</a>)</div><div><br></div>
<div>
My point is that no systematic data validation seems to be made when receiving API requests, leading to potential unwanted behavior or instability.</div><div><br></div><div>I am working on a prototype to enable simple validation of all API requests data using json schemas and the python package <a href="https://pypi.python.org/pypi/jsonschema" target="_blank">jsonschema</a>.</div>
<div><br></div><div>As I am new in the openstack community and also because my work uses the json schema specification which is still a draft with a new package dependency, I was looking for some feedback about this idea before going on and filling a blueprint. </div>
<div><br></div><div>Regards,</div><br clear="all"><div>--<br>Bruno Semperlotti</div>
</div>
<br></div></div><div class="im">_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></div></blockquote></div><br></div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div>