api: document missing version validation in newGroupActivityEntry and newInstanceActivityEntry - #1564
Draft
RamavathChanti wants to merge 1 commit into
Draft
Conversation
… newInstanceActivityEntry newGroupActivityEntry() and newInstanceActivityEntry() in activity.go insert version strings directly into the activity table without calling IsValidSemver(), unlike RegisterInstance() which validates versions. This is the same validation gap as RegisterEvent() - malformed version strings like v1.2.3 or not-a-version pass through unvalidated and get stored in the DB. Add tests documenting the inconsistency across: - TestActivityVersionValidationGap - TestActivityVersionValidationInconsistency - TestActivityFunctionsAffected Signed-off-by: Chanti <chantib107@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
newGroupActivityEntry()andnewInstanceActivityEntry()inactivity.goinsert version strings directly into the activity table without callingIsValidSemver(), unlikeRegisterInstance()which validates versions before storing them.Before vs After
Before — no validation in activity functions:
// RegisterInstance() validates
if !dbreads.IsValidSemver(instApp.Version) {
return nil, ErrInvalidSemver
}
// newGroupActivityEntry() does NOT validate
Vals(goqu.Vals{class, severity, version, appID, groupID})
// newInstanceActivityEntry() does NOT validate
Vals(goqu.Vals{class, severity, version, appID, groupID, instanceID})
After — consistent validation:
if version != "" && !dbreads.IsValidSemver(version) {
return ErrInvalidSemver
}
Changes
backend/pkg/api/internal/dbreads/activity_version_validation_test.go(new) — 3 tests documenting the validation gapHow to use
cd backend && go test -v -run "TestActivity" ./pkg/api/internal/dbreads/...
Testing done
=== RUN TestActivityVersionValidationGap
--- PASS (0.00s)
=== RUN TestActivityVersionValidationInconsistency
--- PASS (0.00s)
=== RUN TestActivityFunctionsAffected
--- PASS (0.00s)
ok github.com/flatcar/nebraska/backend/pkg/api/internal/dbreads 0.012s
Fixes #1563