Raise RequestParameterInvalidException if url can't be verified

Kind of a followup to
https://github.com/galaxyproject/galaxy/pull/18155.

Fixes:
```
ValueError
invalid literal for int() with base 10: 'sequences'
```
For the attempted url `"http://emp-single-end-sequences:sequences"`.
This commit is contained in:
mvdbeek
2024-05-27 09:54:09 +02:00
parent d8b827f50e
commit 30b1f4b2f9
+15 -10
View File
@@ -6,6 +6,7 @@ import tempfile
from typing import (
List,
Optional,
Tuple,
)
from urllib.parse import urlparse
@@ -78,6 +79,18 @@ def validate_uri_access(uri: str, is_admin: bool, ip_allowlist: List[IpAllowedLi
raise AdminRequiredException()
def split_port(parsed_url: str, url: str) -> Tuple[str, int]:
try:
idx = parsed_url.rindex(":")
# We parse as an int and let this fail ungracefully if parsing
# fails because we desire to fail closed rather than open.
port = int(parsed_url[idx + 1 :])
parsed_url = parsed_url[:idx]
return (parsed_url, port)
except Exception:
raise RequestParameterInvalidException(f"Could not verify url '{url}'.")
def validate_non_local(uri: str, ip_allowlist: List[IpAllowedListEntryT]) -> str:
# If it doesn't look like a URL, ignore it.
if not (uri.lstrip().startswith("http://") or uri.lstrip().startswith("https://")):
@@ -106,22 +119,14 @@ def validate_non_local(uri: str, ip_allowlist: List[IpAllowedListEntryT]) -> str
# However if it ends with a ']' then there is no port after it and
# they've wrapped it in brackets just for fun.
if "]" in parsed_url and not parsed_url.endswith("]"):
# If this +1 throws a range error, we don't care, their url
# shouldn't end with a colon.
idx = parsed_url.rindex(":")
# We parse as an int and let this fail ungracefully if parsing
# fails because we desire to fail closed rather than open.
port = int(parsed_url[idx + 1 :])
parsed_url = parsed_url[:idx]
parsed_url, port = split_port(parsed_url=parsed_url, url=url)
else:
# Plain ipv6 without port
pass
else:
# This should finally be ipv4 with port. It cannot be IPv6 as that
# was caught by earlier cases, and it cannot be due to credentials.
idx = parsed_url.rindex(":")
port = int(parsed_url[idx + 1 :])
parsed_url = parsed_url[:idx]
parsed_url, port = split_port(parsed_url=parsed_url, url=url)
# safe to log out, no credentials/request path, just an IP + port
log.debug("parsed url %s, port: %s", parsed_url, port)