From b97ea7c6b7c52430393ec7107674ba23ff57b9d5 Mon Sep 17 00:00:00 2001
From: Paul Joseph Davis <davisp@apache.org>
Date: Mon, 27 Apr 2009 19:41:23 +0000
Subject: Resolves COUCHDB-332 Proper errors for invalid docids.

git-svn-id: https://svn.apache.org/repos/asf/couchdb/trunk@769127 13f79535-47bb-0310-9956-ffa450edef68
---
 share/www/script/test/invalid_docids.js | 10 ++++++++++
 src/couchdb/couch_doc.erl               | 24 ++++++++++++++----------
 src/couchdb/couch_httpd_db.erl          |  2 ++
 3 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/share/www/script/test/invalid_docids.js b/share/www/script/test/invalid_docids.js
index 814d1a21..4fc4bbf5 100644
--- a/share/www/script/test/invalid_docids.js
+++ b/share/www/script/test/invalid_docids.js
@@ -29,6 +29,16 @@ couchTests.invalid_docids = function(debug) {
       T(e.error == "bad_request");
   }
 
+  // Via PUT with _id not in body.
+  var res = res = db.request("PUT", "/test_suite_db/_other", {"body": "{}"});
+  T(res.status == 400);
+  T(JSON.parse(res.responseText).error == "bad_request");
+
+  // Accidental POST to form handling code.
+  res = db.request("POST", "/test_suite_db/_tmp_view", {"body": "{}"});
+  T(res.status == 400);
+  T(JSON.parse(res.responseText).error == "bad_request");
+
   // Test invalid _prefix
   try {
     db.save({"_id": "_invalid"});
diff --git a/src/couchdb/couch_doc.erl b/src/couchdb/couch_doc.erl
index 03cc8906..132c86d0 100644
--- a/src/couchdb/couch_doc.erl
+++ b/src/couchdb/couch_doc.erl
@@ -15,6 +15,7 @@
 -export([to_doc_info/1,to_doc_info_path/1,parse_rev/1,parse_revs/1,rev_to_str/1,rev_to_strs/1]).
 -export([bin_foldl/3,bin_size/1,bin_to_binary/1,get_validate_doc_fun/1]).
 -export([from_json_obj/1,to_json_obj/2,has_stubs/1, merge_stubs/2]).
+-export([validate_docid/1]).
 
 -include("couch_db.hrl").
 
@@ -143,23 +144,26 @@ parse_revs([Rev | Rest]) ->
     [parse_rev(Rev) | parse_revs(Rest)].
 
 
-transfer_fields([], #doc{body=Fields}=Doc) ->
-    % convert fields back to json object
-    Doc#doc{body={lists:reverse(Fields)}};
-    
-transfer_fields([{<<"_id">>, Id} | Rest], Doc) when is_binary(Id) ->
+validate_docid(Id) when is_binary(Id) ->
     case Id of
     <<"_design/", _/binary>> -> ok;
     <<"_local/", _/binary>> -> ok;
     <<"_", _/binary>> ->
         throw({bad_request, <<"Only reserved document ids may start with underscore.">>});
     _Else -> ok
-    end,
-    transfer_fields(Rest, Doc#doc{id=Id});
-    
-transfer_fields([{<<"_id">>, Id} | _Rest], _Doc) ->
+    end;
+validate_docid(Id) ->
     ?LOG_DEBUG("Document id is not a string: ~p", [Id]),
-    throw({bad_request, <<"Document id must be a string">>});
+    throw({bad_request, <<"Document id must be a string">>}).
+
+transfer_fields([], #doc{body=Fields}=Doc) ->
+    % convert fields back to json object
+    Doc#doc{body={lists:reverse(Fields)}};
+    
+transfer_fields([{<<"_id">>, Id} | Rest], Doc) ->
+    io:format("Transfering docid! ~p~n", [Id]),
+    validate_docid(Id),
+    transfer_fields(Rest, Doc#doc{id=Id});
     
 transfer_fields([{<<"_rev">>, Rev} | Rest], #doc{revs={0, []}}=Doc) ->
     {Pos, RevId} = parse_rev(Rev),
diff --git a/src/couchdb/couch_httpd_db.erl b/src/couchdb/couch_httpd_db.erl
index d8a2a971..4fa5a9b6 100644
--- a/src/couchdb/couch_httpd_db.erl
+++ b/src/couchdb/couch_httpd_db.erl
@@ -497,6 +497,7 @@ db_doc_req(#httpd{method='GET'}=Req, Db, DocId) ->
     end;
 
 db_doc_req(#httpd{method='POST'}=Req, Db, DocId) ->
+    couch_doc:validate_docid(DocId),
     case couch_httpd:header_value(Req, "content-type") of
     "multipart/form-data" ++  _Rest ->
         ok;
@@ -525,6 +526,7 @@ db_doc_req(#httpd{method='POST'}=Req, Db, DocId) ->
     ]});
 
 db_doc_req(#httpd{method='PUT'}=Req, Db, DocId) ->
+    couch_doc:validate_docid(DocId),
     Location = absolute_uri(Req, "/" ++ ?b2l(Db#db.name) ++ "/" ++ ?b2l(DocId)),
     update_doc(Req, Db, DocId, couch_httpd:json_body(Req),
       [{"Location", Location}]);
-- 
cgit v1.2.3