Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The value 4 should not be allowed in as a value in security_objectives #1342

Closed
gbyx3 opened this issue Jan 9, 2025 · 1 comment
Closed

Comments

@gbyx3
Copy link
Contributor

gbyx3 commented Jan 9, 2025

When creating assets via the api (POST /api/assets/) the security_objectives values is not properly validated.
It checks for an integer but not for a max value of >=3.
This causes an internal server error and the asset page fails to load.
This issue is similar to #1329, the fix for this issue does not solve this.

To Reproduce
Steps to reproduce the behavior:

  1. Make a POST request to /api/assets/
  2. Payload:
{
  "is_published": true,
  "name": "Some name",
  "type": "PR",
  "folder": "<CHANGE ME>",
  "security_objectives": {
    "objectives": {
      "confidentiality": {
        "value": 4,
        "is_enabled": true
      }
    }
  }
}
  1. Refresh the Assets page under Organization
  2. See error

Expected behavior
Block the request with "4 is not a valid integer for value"...

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

  • Device: Mac and PC
  • OS: OsX, Debian
  • Browser Firefox
  • Version 133.0.3

Additional context
See thread "Asset import with API" in the "tech-chat" channel on discord

@gbyx3
Copy link
Contributor Author

gbyx3 commented Jan 9, 2025

Should be solved in #1343 and #1344

@gbyx3 gbyx3 closed this as completed Jan 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant