Merge lp:~benji/lazr.restful/error-on-multiple-ws.op-fields into lp:lazr.restful

[Benji York]

Bug 842917 describes an unhandled TypeError raised when more than one
value for ws.op is provided in web service requests. This branch fixes
that by simply ensuring there is only one ws.op value (which is a
string) and generating a 400 with an informative message if not.

[j.c.sackett (jcsackett)]

This looks good to land (based on http://paste.ubuntu.com/685561/).

review: Approve

=== modified file 'src/lazr/restful/_resource.py'
--- src/lazr/restful/_resource.py	2011-09-07 20:46:50 +0000
+++ src/lazr/restful/_resource.py	2011-09-08 20:43:24 +0000
@@ -700,6 +700,10 @@
         :return: The result of the operation: either a string or an
         object that needs to be serialized to JSON.
         """
+        if not isinstance(operation_name, basestring):
+            self.request.response.setStatus(400)
+            return "Expected a single operation: %r" % (operation_name,)
+
         try:
             operation = getMultiAdapter((self.context, self.request),
                                         IResourceGETOperation,
@@ -722,6 +726,10 @@
         :return: The result of the operation: either a string or an
         object that needs to be serialized to JSON.
         """
+        if not isinstance(operation_name, basestring):
+            self.request.response.setStatus(400)
+            return "Expected a single operation: %r" % (operation_name,)
+
         try:
             operation = getMultiAdapter((self.context, self.request),
                                         IResourcePOSTOperation,

=== modified file 'src/lazr/restful/tests/test_webservice.py'
--- src/lazr/restful/tests/test_webservice.py	2011-03-31 01:13:59 +0000
+++ src/lazr/restful/tests/test_webservice.py	2011-09-08 20:43:24 +0000
@@ -1005,3 +1005,32 @@
                 IHasOneField, HasOneField, "") as resource:
             resource.applyChanges({})
         self.assertEquals(len(eventtesting.getEvents()), 0)
+
+
+class MalformedRequest(EntryTestCase):
+
+    testmodule_objects = [HasOneField, IHasOneField]
+    default_media_type = "application/xhtml+xml"
+
+    def setUp(self):
+        super(MalformedRequest, self).setUp()
+        self._register_url_adapter(IHasOneField)
+        self.unicode_message = u"Hello from a \N{SNOWMAN}"
+
+    def test_multiple_named_operations_generate_error_on_GET(self):
+        with self.entry_resource(
+                IHasOneField, HasOneField, self.unicode_message) as resource:
+            resource.request.form['ws.op'] = ['foo', 'bar']
+            result = resource.do_GET()
+        self.assertEquals(resource.request.response.getStatus(), 400)
+        self.assertEquals(
+            result, "Expected a single operation: ['foo', 'bar']")
+
+    def test_multiple_named_operations_generate_error_on_POST(self):
+        with self.entry_resource(
+                IHasOneField, HasOneField, self.unicode_message) as resource:
+            resource.request.form['ws.op'] = ['foo', 'bar']
+            result = resource.do_POST()
+        self.assertEquals(resource.request.response.getStatus(), 400)
+        self.assertEquals(
+            result, "Expected a single operation: ['foo', 'bar']")