Description of problem: there seems to be no input validation for parameters provided to /api/hosts/<host>/errata/apply (specifically errata_ids parameter): <pre> $ curl -k -u admin:changeme -X PUT -H 'Content-Type: application/json' -d '{"errata_ids": []}' https://sat6.server.com/api/v2/hosts/12977/errata/apply {"displayMessage":"undefined method `-' for nil:NilClass","errors":["undefined method `-' for nil:NilClass"]} $ curl -k -u admin:changeme -X PUT -H 'Content-Type: application/json' -d '{"errata_ids": 1}' https://sat6.server.com/api/v2/hosts/12977/errata/apply {"displayMessage":"ERROR: operator does not exist: character varying = integer\nLINE 1: ...ROM \"katello_errata\" WHERE \"katello_errata\".\"errata_id\" = 1\n ^\nHINT: No operator matches the given name and argument type(s). You might need to add explicit type casts.\n","errors":["ERROR: operator does not exist: character varying = integer\nLINE 1: ...ROM \"katello_errata\" WHERE \"katello_errata\".\"errata_id\" = 1\n ^\nHINT: No operator matches the given name and argument type(s). You might need to add explicit type casts.\n"]} </pre> Version-Release number of selected component (if applicable): 6.2.0 Beta How reproducible: always Steps to Reproduce: 1. get some hosts registered to your satellite 2. send out one of the PUT HTTP requests (as stated above) Actual results: no input validation happens on the parameters, so the code uses any input and crashes with it (wrong or null type, etc.) Expected results: validation takes place and raise proper exception if the input is invalid, user receives properly formatted error message in the JSON response. Additional info:
Note: this bug is similar to bug 1222127 which requests a similar validation for host-collections.
Created redmine issue http://projects.theforeman.org/issues/18744 from this bug
Upstream bug assigned to kgaikwad
Thank you for your interest in Satellite 6. We have evaluated this request, and we do not expect this to be implemented in the product in the foreseeable future. We are therefore closing this out as WONTFIX. If you have any concerns about this, please feel free to contact Rich Jerrido or Bryan Kearney. Thank you.