toastdriven/django-tastypie — Issue #267: Potentially dangerous Resource.get_via_uri behavior
Author: ryankask
Created: 2011-10-18 11:38:09+00:00
State: open

I've searched around and I think I've found some dangerous behavior in ``Resource.get_via_uri`` that hasn't been reported. I'd like some more eyes to confirm the issue.

At the moment, the code allows *any* provided URI that resolves to return an object if there is only one of those objects returned by ``ModelResource.get_object_list``.

``Resource.get_via_uri`` is called (I don't know if this is the only place) when ``Resource.full_hydrate`` is called (through ``fields.ToOneField.hydrate`` -> ``fields.RelatedField.build_related_resource``).

Here is the relevant code:

try:
view, args, kwargs = resolve(chomped_uri)
except Resolver404:
raise NotFound("The URL provided '%s' was not a link to a valid resource." % uri)

return self.obj_get(request=request, **self.remove_api_resource_names(kwargs))

If ``uri`` equals *any* string that ``resolve`` works for (say, for a totally unrelated message app that where resolve('/message/create') returns a view, etc.), then the code proceeds to call ``ModelResource.obj_get``.

Given the way ``ModelResource.obj_get`` works, if ``ModelResource.get_object_list(request).count() == 1``, then that one object will be returned.

This doesn't seem correct to me although maybe it was intended (?). The current tests can sort of catch there are many ``Note`` objects in the database; ``MultipleObjectsReturned`` will handle this (This generates a 500... which also doesn't seem right to me). But if there was only one ``Note``, then the test would fail (i.e. the one ``Note`` would be returned).

I've illustrated this in the attached patch to the tests.