Edited `nova.api.openstack.common:limited` method to raise an HTTPBadRequest

exception if a negative limit or offset is given. I'm not confident that this
is the correct approach, because I guess this method could be called out of
an API/WSGI context, but the method *is* located in the OpenStack API module
and is currently only used in WSGI-capable methods, so we should be safe.

1 files changed, 7 insertions, 1 deletions

diff --git a/nova/api/openstack/common.py b/nova/api/openstack/common.py
index 1dc3767e2..9f85c5c8a 100644
--- a/nova/api/openstack/common.py
+++ b/nova/api/openstack/common.py
@@ -15,6 +15,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import webob.exc
+
 from nova import exception
 
 
@@ -27,7 +29,8 @@ def limited(items, request, max_limit=1000):
                     GET variables. 'offset' is where to start in the list,
                     and 'limit' is the maximum number of items to return. If
                     'limit' is not specified, 0, or > max_limit, we default
-                    to max_limit.
+                    to max_limit. Negative values for either offset or limit
+                    will cause exc.HTTPBadRequest() exceptions to be raised.
     @kwarg max_limit: The maximum number of items to return from 'items'
     """
     try:
@@ -40,6 +43,9 @@ def limited(items, request, max_limit=1000):
     except ValueError:
         limit = max_limit
 
+    if offset < 0 or limit < 0:
+        raise webob.exc.HTTPBadRequest()
+
     limit = min(max_limit, limit or max_limit)
     range_end = offset + limit
     return items[offset:range_end]