Protect against missing permissions field.

ArtifactDB · Oct 18, 2024 · 5ca00bc · 5ca00bc
1 parent 03e02fe
commit 5ca00bc
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/permissions.go b/permissions.go
@@ -208,6 +208,10 @@ func setPermissionsHandler(reqpath string, globals *globalConfiguration) error {
         if err != nil {
             return newHttpError(http.StatusBadRequest, fmt.Errorf("invalid 'project' property in %q; %w", reqpath, err))
         }
+
+        if incoming.Permissions == nil {
+            return newHttpError(http.StatusBadRequest, fmt.Errorf("expected a 'permissions' object in %q", reqpath))
+        }
     }
 
     source_user, err := identifyUser(reqpath)

diff --git a/permissions_test.go b/permissions_test.go
@@ -392,7 +392,7 @@ func TestSetPermissionsHandlerHandler(t *testing.T) {
 
         reqpath, err := dumpRequest(
             "set_permissions",
-            fmt.Sprintf(`{ "project": "%s" }`, project),
+            fmt.Sprintf(`{ "project": "%s", "permissions": {} }`, project),
         )
         if err != nil {
             t.Fatalf("failed to dump a request type; %v", err)