From 6c891bb54c36cb919afffa34228090b4fec46e84 Mon Sep 17 00:00:00 2001 From: Charlie Tonneslan Date: Sun, 17 May 2026 19:59:46 -0400 Subject: [PATCH] Validate lat/lon as floats before interpolating into the geo GraphQL query find_your_legislator was taking lat and lon straight off the query string and slotting them into a GraphQL query via % formatting. Anything non-numeric flowed through to schema.execute and broke the query (potentially with whatever GraphQL the caller fed in). Parse them as floats up front so the value going into the query is always a number, and return a 400 with a clear message when it isn't. Signed-off-by: Charlie Tonneslan --- public/views/legislators.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/public/views/legislators.py b/public/views/legislators.py index 61d8c5597..c419c307c 100644 --- a/public/views/legislators.py +++ b/public/views/legislators.py @@ -30,6 +30,11 @@ def _people_from_lat_lon(lat, lon): } } }""" + # lat/lon come straight off the query string and get interpolated into a + # GraphQL query string below, so make sure they actually parse as floats + # before we hand the result to schema.execute. + lat = float(lat) + lon = float(lon) resp = schema.execute(PERSON_GEO_QUERY % (lat, lon)) nodes = [node["node"] for node in resp.data["people"]["edges"]] @@ -67,7 +72,12 @@ def find_your_legislator(request): if json and lat and lon: # got a passed lat/lon. Let's build off it. - people = _people_from_lat_lon(lat, lon) + try: + people = _people_from_lat_lon(lat, lon) + except ValueError: + return JsonResponse( + {"error": "lat and lon must be numeric"}, status=400 + ) return JsonResponse({"legislators": people}) return render(request, "public/views/find_your_legislator.html", {})