Improve validation of low-level data submissions

This issue belongs to an archived project. You can view it, but you can't modify it. Learn more

XMLWordPrintable

    • Type: Improvement
    • Resolution: Unresolved
    • Priority: Normal
    • None
    • Affects Version/s: None
    • Component/s: Server
    • None

      Currently we only check if some items are present in submitted JSON (see SANITY_CHECK_KEYS list at https://github.com/metabrainz/acousticbrainz-server/blob/master/db/data.py#L16-L30 and code that uses it). However it's easy to put any value into `lowlevel`, for example. There are two problems with this:
      1. High-level extractor depends on values in keys defined there.
      2. It's bad to accept arbitrary data (even if it's somewhat limited). See https://www.owasp.org/index.php/Don't_trust_user_input.

      We know exactly what kind of output low-level extractor produces and submits to AcousticBrainz, so it shouldn't be a problem to make sure that structure and types are correct. We can use JSON Schema for this purpose.

            Assignee:
            Unassigned
            Reporter:
            Roman
            Archiver:
            julian45

              Created:
              Updated:
              Archived:

                Version Package