diff options
| author | Simo Sorce <simo@redhat.com> | 2015-04-07 16:45:48 -0400 |
|---|---|---|
| committer | Simo Sorce <simo@redhat.com> | 2015-04-07 17:44:46 -0400 |
| commit | a438d0d27d70cfdc2dcfdd929564375184bb88ff (patch) | |
| tree | f8a8c45b021f6a3acd0187b8949dc2b6dd344ee2 /custodia | |
| parent | 2f80a39339bdea5d8917e4c2bd2abf2b42c3c5b5 (diff) | |
| download | custodia-a438d0d27d70cfdc2dcfdd929564375184bb88ff.tar.gz custodia-a438d0d27d70cfdc2dcfdd929564375184bb88ff.tar.xz custodia-a438d0d27d70cfdc2dcfdd929564375184bb88ff.zip | |
Defensive parsing
Allow only specific commands, we do not want to allow users to end up
being able to access internal functions with arbitrary names.
Diffstat (limited to 'custodia')
| -rw-r--r-- | custodia/httpd/consumer.py | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/custodia/httpd/consumer.py b/custodia/httpd/consumer.py index 8f86ebf..bf0c393 100644 --- a/custodia/httpd/consumer.py +++ b/custodia/httpd/consumer.py @@ -4,6 +4,7 @@ from custodia.httpd.server import HTTPError DEFAULT_CTYPE = 'text/html; charset=utf-8' +SUPPORTED_COMMANDS = ['GET', 'PUT', 'POST', 'DELETE'] class HTTPConsumer(object): @@ -25,6 +26,8 @@ class HTTPConsumer(object): def _find_handler(self, request): base = self command = request.get('command', 'GET') + if command not in SUPPORTED_COMMANDS: + raise HTTPError(501) trail = request.get('trail', None) if trail is not None: for comp in trail: |