Browse Source

Add a check for boundary rules for QUERY (tornado)

    QUERY requires that the request variable for number of queries be
    bound between 1 and 500; anything less than 1 should result in 1
    result and anything more than 500 should result in 500.

    If the test does not clamp the request variable as such, then it
    fails validation.
yushengjun 11 years ago
parent
commit
a966e389ea
1 changed files with 12 additions and 6 deletions
  1. 12 6
      tornado/server.py

+ 12 - 6
tornado/server.py

@@ -1,7 +1,9 @@
-import random
-import sys
+#!/usr/bin/env python
 
+import sys
 import json
+from random import randint
+
 import motor
 import tornado.ioloop
 import tornado.web
@@ -39,16 +41,20 @@ class PlaintextHandler(BaseHandler):
 class QueryTestHandler(BaseHandler):
     @gen.coroutine
     def get(self):
-        queries = int(self.get_argument("queries", 0))
+        try:
+            queries = int(self.get_argument("queries", 1))
+        except Exception:
+            queries = 1
 
-        if queries == 0:
-            random_id = random.randint(1, 10000)
+        if queries <= 1:
+            random_id = randint(1, 10000)
             world = yield motor.Op(db.World.find_one, random_id)
             # Get first postion on arguments, and so first postion in mongo return
             world['id'] = str(world.pop('_id'))
             response = json.dumps(world)
         else:
-            worlds = yield [motor.Op(db.World.find_one, random.randint(1, 10000))
+            queries = min(queries, 500)
+            worlds = yield [motor.Op(db.World.find_one, randint(1, 10000))
                             for _ in xrange(queries)]
             for world in worlds:
                 # Get first postion on arguments, and so first postion in mongo return