-
Notifications
You must be signed in to change notification settings - Fork 108
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Further Sanitize User Input #425
Conversation
Also, cc: @diegonavarro-lyft @0xp4blo |
if data.get('name') != _cred.name: | ||
data['name'] = escape(data.get('name')) | ||
for cred in Credential.data_type_date_index.query( | ||
'credential', | ||
filter_condition=Credential.name == data['name']): | ||
# Conflict, the name already exists | ||
msg = f'Name already exists. See id: {cred.id}' | ||
return jsonify({'error': msg, 'reference': cred.id}), 409 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
what about the latency here? i remember you mentioned a high latency for check dup
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the whole dup check adds more latency since we need to decrypt credential pairs to verify if the cred is a full duplicate. this check is only for dup name, which is not as expensive
This reverts commit 0bdd433.
This reverts commit 8e24934.
In this PR we fix the following issues: