Repository: wagtail/wagtail

Issue:
Remove assert statements from Wagtail API
There's a few places in Wagtail API where we used assert statements to check parameters. These statements are removed when Python optimisations are enabled (see https://github.com/rohe/pysaml2/issues/451) so we should replace these.

- https://github.com/wagtail/wagtail/blob/8b420b9abcfd7c4ede23f0b52fa60d81e640eb82/wagtail/api/v2/pagination.py#L16
- https://github.com/wagtail/wagtail/blob/8b420b9abcfd7c4ede23f0b52fa60d81e640eb82/wagtail/api/v2/pagination.py#L27
- https://github.com/wagtail/wagtail/blob/fd2753667b185e66d68fe9601dce6036a768419d/wagtail/api/v2/filters.py#L146
 - https://github.com/wagtail/wagtail/blob/fd2753667b185e66d68fe9601dce6036a768419d/wagtail/api/v2/filters.py#L193
 
None of these lead to security bugs. But it's not ideal that the behaviour changes depending on how you're running Python.


Discussion:

Resolving patch:
diff --git a/wagtail/api/v2/filters.py b/wagtail/api/v2/filters.py
--- a/wagtail/api/v2/filters.py
+++ b/wagtail/api/v2/filters.py
@@ -143,10 +143,11 @@ def filter_queryset(self, request, queryset, view):
         if 'child_of' in request.GET:
             try:
                 parent_page_id = int(request.GET['child_of'])
-                assert parent_page_id >= 0
+                if parent_page_id < 0:
+                    raise ValueError()
 
                 parent_page = self.get_page_by_id(request, parent_page_id)
-            except (ValueError, AssertionError):
+            except ValueError:
                 if request.GET['child_of'] == 'root':
                     parent_page = self.get_root_page(request)
                 else:
@@ -190,10 +191,11 @@ def filter_queryset(self, request, queryset, view):
                 raise BadRequestError("filtering by descendant_of with child_of is not supported")
             try:
                 parent_page_id = int(request.GET['descendant_of'])
-                assert parent_page_id >= 0
+                if parent_page_id < 0:
+                    raise ValueError()
 
                 parent_page = self.get_page_by_id(request, parent_page_id)
-            except (ValueError, AssertionError):
+            except ValueError:
                 if request.GET['descendant_of'] == 'root':
                     parent_page = self.get_root_page(request)
                 else:
diff --git a/wagtail/api/v2/pagination.py b/wagtail/api/v2/pagination.py
--- a/wagtail/api/v2/pagination.py
+++ b/wagtail/api/v2/pagination.py
@@ -13,21 +13,23 @@ def paginate_queryset(self, queryset, request, view=None):
 
         try:
             offset = int(request.GET.get('offset', 0))
-            assert offset >= 0
-        except (ValueError, AssertionError):
+            if offset < 0:
+                raise ValueError()
+        except ValueError:
             raise BadRequestError("offset must be a positive integer")
 
         try:
             limit_default = 20 if not limit_max else min(20, limit_max)
             limit = int(request.GET.get('limit', limit_default))
-
-            if limit_max and limit > limit_max:
-                raise BadRequestError("limit cannot be higher than %d" % limit_max)
-
-            assert limit >= 0
-        except (ValueError, AssertionError):
+            if limit < 0:
+                raise ValueError()
+        except ValueError:
             raise BadRequestError("limit must be a positive integer")
 
+        if limit_max and limit > limit_max:
+            raise BadRequestError(
+                "limit cannot be higher than %d" % limit_max)
+
         start = offset
         stop = offset + limit
 


Test patch: