Set up input validation for Identifiers on settings bundles

Implemented first input validation steps by making static validation on
identifiers in settings bundle requests.

pkg/proto/v0/settings.pb.micro_test.go

@@ -3,6 +3,7 @@ package proto_test
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"log"
 	"os"
 	"testing"
@@ -74,9 +75,13 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			"सिम्प्ले-display-name",
 			"सिम्प्ले-extension-name",
 			"सिम्प्ले",
-			CustomError{},
+			CustomError{
+				ID:     "go.micro.client",
+				Code:   500,
+				Detail: "bundle_key: must be in a valid format; extension: must be in a valid format.",
+				Status: "Internal Server Error",
+			},
 		},
-		//https://github.com/owncloud/ocis-settings/issues/15
 		{
 			"bundle key with ../ in the name",
 			"../file-a-level-higher-up",
@@ -84,9 +89,13 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			"simple-display-name",
 			"simple-extension-name",
 			"123e4567-e89b-12d3-a456-426652340000",
-			CustomError{},
+			CustomError{
+				ID:     "go.micro.client",
+				Code:   500,
+				Detail: "bundle_key: must be in a valid format.",
+				Status: "Internal Server Error",
+			},
 		},
-		//https://github.com/owncloud/ocis-settings/issues/15
 		{
 			"bundle key in the root directory",
 			"/tmp/file",
@@ -97,11 +106,10 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			CustomError{
 				ID:     "go.micro.client",
 				Code:   500,
-				Detail: "open ocis-settings-store/bundles/simple-extension-name/tmp/file.json: no such file or directory",
+				Detail: "bundle_key: must be in a valid format.",
 				Status: "Internal Server Error",
 			},
 		},
-		//https://github.com/owncloud/ocis-settings/issues/15
 		{
 			"extension name with ../ in the name",
 			"simple-bundle-key",
@@ -109,9 +117,13 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			"simple-display-name",
 			"../folder-a-level-higher-up",
 			"123e4567-e89b-12d3-a456-426652340000",
-			CustomError{},
+			CustomError{
+				ID:     "go.micro.client",
+				Code:   500,
+				Detail: "extension: must be in a valid format.",
+				Status: "Internal Server Error",
+			},
 		},
-		//https://github.com/owncloud/ocis-settings/issues/16
 		{
 			"extension name with \\ in the name",
 			"simple-bundle-key",
@@ -119,9 +131,13 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			"simple-display-name",
 			"\\",
 			"123e4567-e89b-12d3-a456-426652340000",
-			CustomError{},
+			CustomError{
+				ID:     "go.micro.client",
+				Code:   500,
+				Detail: "extension: must be in a valid format.",
+				Status: "Internal Server Error",
+			},
 		},
-		//https://github.com/owncloud/ocis-settings/issues/16
 		{
 			"bundle key with \\ as the name",
 			"\\",
@@ -129,7 +145,12 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			"simple-display-name",
 			"simple-extension-name",
 			"123e4567-e89b-12d3-a456-426652340000",
-			CustomError{},
+			CustomError{
+				ID:     "go.micro.client",
+				Code:   500,
+				Detail: "bundle_key: must be in a valid format.",
+				Status: "Internal Server Error",
+			},
 		},
 		{
 			"spaces in values",
@@ -150,7 +171,7 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			CustomError{
 				ID:     "go.micro.client",
 				Code:   500,
-				Detail: "rpc error: code = InvalidArgument desc = Missing a required identifier attribute",
+				Detail: "bundle_key: cannot be blank.",
 				Status: "Internal Server Error",
 			},
 		},
@@ -164,12 +185,12 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			CustomError{
 				ID:     "go.micro.client",
 				Code:   500,
-				Detail: "rpc error: code = InvalidArgument desc = Missing a required identifier attribute",
+				Detail: "extension: cannot be blank.",
 				Status: "Internal Server Error",
 			},
 		},
 		{
-			"setting key missing",
+			"setting key missing (omitted on bundles)",
 			"simple-bundle-key",
 			"",
 			"simple-display-name",
@@ -187,7 +208,7 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			CustomError{},
 		},
 		{
-			"UUID missing",
+			"UUID missing (omitted on bundles)",
 			"simple-bundle-key",
 			"simple-key",
 			"simple-display-name",
@@ -218,6 +239,7 @@ func TestSaveGetSettingsBundleWithNoSettings(t *testing.T) {
 			cl := proto.NewBundleService("com.owncloud.api.settings", client)
 
 			cresponse, err := cl.SaveSettingsBundle(context.Background(), &createRequest)
+			fmt.Println(err)
 			if err != nil || (CustomError{} != testCase.expectedError) {
 				var errorData CustomError
 				_ = json.Unmarshal([]byte(err.Error()), &errorData)

pkg/service/v0/service.go

@@ -2,7 +2,6 @@ package svc
 
 import (
 	"context"
-
 	"github.com/owncloud/ocis-pkg/v2/middleware"
 	"github.com/owncloud/ocis-settings/pkg/config"
 	"github.com/owncloud/ocis-settings/pkg/proto/v0"
@@ -27,6 +26,9 @@ func NewService(cfg *config.Config) Service {
 // SaveSettingsBundle implements the BundleServiceHandler interface
 func (g Service) SaveSettingsBundle(c context.Context, req *proto.SaveSettingsBundleRequest, res *proto.SaveSettingsBundleResponse) error {
 	req.SettingsBundle.Identifier = getFailsafeIdentifier(c, req.SettingsBundle.Identifier)
+	if validationError := validateSaveSettingsBundle(req); validationError != nil {
+		return validationError
+	}
 	r, err := g.manager.WriteBundle(req.SettingsBundle)
 	if err != nil {
 		return err
@@ -37,7 +39,11 @@ func (g Service) SaveSettingsBundle(c context.Context, req *proto.SaveSettingsBu
 
 // GetSettingsBundle implements the BundleServiceHandler interface
 func (g Service) GetSettingsBundle(c context.Context, req *proto.GetSettingsBundleRequest, res *proto.GetSettingsBundleResponse) error {
-	r, err := g.manager.ReadBundle(getFailsafeIdentifier(c, req.Identifier))
+	req.Identifier = getFailsafeIdentifier(c, req.Identifier)
+	if validationError := validateGetSettingsBundle(req); validationError != nil {
+		return validationError
+	}
+	r, err := g.manager.ReadBundle(req.Identifier)
 	if err != nil {
 		return err
 	}
@@ -47,7 +53,11 @@ func (g Service) GetSettingsBundle(c context.Context, req *proto.GetSettingsBund
 
 // ListSettingsBundles implements the BundleServiceHandler interface
 func (g Service) ListSettingsBundles(c context.Context, req *proto.ListSettingsBundlesRequest, res *proto.ListSettingsBundlesResponse) error {
-	r, err := g.manager.ListBundles(getFailsafeIdentifier(c, req.Identifier))
+	req.Identifier = getFailsafeIdentifier(c, req.Identifier)
+	if validationError := validateListSettingsBundles(req); validationError != nil {
+		return validationError
+	}
+	r, err := g.manager.ListBundles(req.Identifier)
 	if err != nil {
 		return err
 	}
@@ -58,6 +68,9 @@ func (g Service) ListSettingsBundles(c context.Context, req *proto.ListSettingsB
 // SaveSettingsValue implements the ValueServiceHandler interface
 func (g Service) SaveSettingsValue(c context.Context, req *proto.SaveSettingsValueRequest, res *proto.SaveSettingsValueResponse) error {
 	req.SettingsValue.Identifier = getFailsafeIdentifier(c, req.SettingsValue.Identifier)
+	if validationError := validateSaveSettingsValue(req); validationError != nil {
+		return validationError
+	}
 	r, err := g.manager.WriteValue(req.SettingsValue)
 	if err != nil {
 		return err
@@ -68,7 +81,11 @@ func (g Service) SaveSettingsValue(c context.Context, req *proto.SaveSettingsVal
 
 // GetSettingsValue implements the ValueServiceHandler interface
 func (g Service) GetSettingsValue(c context.Context, req *proto.GetSettingsValueRequest, res *proto.GetSettingsValueResponse) error {
-	r, err := g.manager.ReadValue(getFailsafeIdentifier(c, req.Identifier))
+	req.Identifier = getFailsafeIdentifier(c, req.Identifier)
+	if validationError := validateGetSettingsValue(req); validationError != nil {
+		return validationError
+	}
+	r, err := g.manager.ReadValue(req.Identifier)
 	if err != nil {
 		return err
 	}
@@ -78,7 +95,11 @@ func (g Service) GetSettingsValue(c context.Context, req *proto.GetSettingsValue
 
 // ListSettingsValues implements the ValueServiceHandler interface
 func (g Service) ListSettingsValues(c context.Context, req *proto.ListSettingsValuesRequest, res *proto.ListSettingsValuesResponse) error {
-	r, err := g.manager.ListValues(getFailsafeIdentifier(c, req.Identifier))
+	req.Identifier = getFailsafeIdentifier(c, req.Identifier)
+	if validationError := validateListSettingsValues(req); validationError != nil {
+		return validationError
+	}
+	r, err := g.manager.ListValues(req.Identifier)
 	if err != nil {
 		return err
 	}

pkg/service/v0/validator.go

@@ -0,0 +1,86 @@
+package svc
+
+import (
+	"regexp"
+
+	validation "github.com/go-ozzo/ozzo-validation/v4"
+	"github.com/go-ozzo/ozzo-validation/v4/is"
+	"github.com/owncloud/ocis-settings/pkg/proto/v0"
+)
+
+var (
+	regexForKeys = regexp.MustCompile("^[A-Za-z0-9\\-_]*$")
+	keyRule = []validation.Rule{
+		validation.Required,
+		validation.Match(regexForKeys),
+	}
+	settingKeyRule = []validation.Rule{
+		validation.Required,
+		validation.Match(regexForKeys),
+	}
+	accountUuidRule = []validation.Rule{
+		validation.Required,
+		is.UUID,
+	}
+)
+
+func validateSaveSettingsBundle(req *proto.SaveSettingsBundleRequest) error {
+	if err := validateBundleIdentifier(req.SettingsBundle.Identifier); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateGetSettingsBundle(req *proto.GetSettingsBundleRequest) error {
+	if err := validateBundleIdentifier(req.Identifier); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateListSettingsBundles(req *proto.ListSettingsBundlesRequest) error {
+	if err := validateBundleIdentifier(req.Identifier); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateSaveSettingsValue(req *proto.SaveSettingsValueRequest) error {
+	if err := validateValueIdentifier(req.SettingsValue.Identifier); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateGetSettingsValue(req *proto.GetSettingsValueRequest) error {
+	if err := validateValueIdentifier(req.Identifier); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateListSettingsValues(req *proto.ListSettingsValuesRequest) error {
+	if err := validateValueIdentifier(req.Identifier); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateBundleIdentifier(identifier *proto.Identifier) error {
+	return validation.ValidateStruct(
+		identifier,
+		validation.Field(&identifier.Extension, keyRule...),
+		validation.Field(&identifier.BundleKey, keyRule...),
+	)
+}
+
+func validateValueIdentifier(identifier *proto.Identifier) error {
+	return validation.ValidateStruct(
+		identifier,
+		validation.Field(&identifier.Extension, keyRule...),
+		validation.Field(&identifier.BundleKey, keyRule...),
+		validation.Field(&identifier.SettingKey, settingKeyRule...),
+		validation.Field(&identifier.AccountUuid, accountUuidRule...),
+	)
+}
+