Bug 1558618 - CustomAttributeMixin#miq_custom_set should prevent setting attributes with spaces, colons or any other invalid column characters
Summary: CustomAttributeMixin#miq_custom_set should prevent setting attributes with sp...
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: Appliance
Version: 5.9.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: GA
: 5.9.5
Assignee: Gregg Tanzillo
QA Contact: Dave Johnson
URL:
Whiteboard:
Depends On:
Blocks: 1595269
TreeView+ depends on / blocked
 
Reported: 2018-03-20 15:51 UTC by Joe Rafaniello
Modified: 2021-06-10 15:25 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-09-14 13:00:42 UTC
Category: ---
Cloudforms Team: ---
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Joe Rafaniello 2018-03-20 15:51:22 UTC
Description of problem: miq_custom_set allows you to name a custom attribute with a space, colon, etc.

It should have a validation that fails.
Found in:  https://bugzilla.redhat.com/show_bug.cgi?id=1553750#c15

Note, this change needs to allow our existing provider/ems refreshes/scans to properly set the custom attribute as they currently already do.  We cannot break existing code for refreshes and vm scans in order to fix this bug.



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
from: https://www.postgresql.org/docs/current/static/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS

SQL identifiers and key words must begin with a letter (a-z, but also letters with diacritical marks and non-Latin letters) or an underscore (_). Subsequent characters in an identifier or key word can be letters, underscores, digits (0-9), or dollar signs ($). Note that dollar signs are not allowed in identifiers according to the letter of the SQL standard, so their use might render applications less portable. The SQL standard will not define a key word that contains digits or starts or ends with an underscore, so identifiers of this form are safe against possible conflict with future extensions of the standard.

Comment 2 Dave Johnson 2018-03-20 16:04:34 UTC
Please assess the impact of this issue and update the severity accordingly.  Please refer to https://bugzilla.redhat.com/page.cgi?id=fields.html#bug_severity for a reminder on each severity's definition.

If it's something like a tracker bug where it doesn't matter, please set the severity to Low.


Note You need to log in before you can comment on or make changes to this bug.