From 6f4ad7db3205c4d52070e9fc8b89d4bf8f722b5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= Date: Sun, 2 Aug 2026 09:56:19 +0400 Subject: [PATCH] =?UTF-8?q?v0.5.6:=20fix=20=D0=B0=D1=83=D0=B4=D0=B8=D1=82?= =?UTF-8?q?=20=D0=A1=D0=BE=D0=BD=D0=BD=D0=B5=D1=82=D0=B0=20=E2=80=94=20app?= =?UTF-8?q?ly=5Feffect=20=D1=81=D1=82=D0=B5=D0=BD=D0=B4,=20mock=5Fservices?= =?UTF-8?q?,=20XSS,=20paramId=20=D0=B2=D0=B0=D0=BB=D0=B8=D0=B4=D0=B0=D1=86?= =?UTF-8?q?=D0=B8=D1=8F,=20serviceId=3D0=20test?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- site/config/loader.py | 2 +- site/routes/mock_routes.py | 2 +- site/routes/openapi.py | 2 +- site/routes/operations_routes.py | 4 ++++ site/routes/run.py | 2 +- site/templates/swagger.html | 6 +++--- tests/fuzz_test.py | 2 +- 7 files changed, 12 insertions(+), 8 deletions(-) diff --git a/site/config/loader.py b/site/config/loader.py index 74ee918..5dc0c37 100644 --- a/site/config/loader.py +++ b/site/config/loader.py @@ -80,7 +80,7 @@ SERVICES = _DF["SERVICES"] OPS_INDEX = _DF["OPS_INDEX"] DELAY = float(os.getenv("MOCK_OP_DELAY", "0.1")) -VERSION = "0.5.5" +VERSION = "0.5.6" def get_services(stand_id): diff --git a/site/routes/mock_routes.py b/site/routes/mock_routes.py index 205473d..e7c6630 100644 --- a/site/routes/mock_routes.py +++ b/site/routes/mock_routes.py @@ -97,7 +97,7 @@ def mock_services(): не дёргая реальный /api/v1/svc/services. """ result = {} - for svc_id, svc_def in _cfg.SERVICES.items(): + for svc_id, svc_def in SERVICES.items(): result[str(svc_id)] = { "name": svc_def.get("name", ""), "displayName": svc_def.get("service_display_name", ""), diff --git a/site/routes/openapi.py b/site/routes/openapi.py index 56e144b..5a912b3 100644 --- a/site/routes/openapi.py +++ b/site/routes/openapi.py @@ -429,7 +429,7 @@ def _build_paths(): "content": { "application/json": { "schema": {"$ref": "#/components/schemas/CreateInstanceRequest"}, - "example": {"serviceId": 38, "displayName": "my-test-instance"}, + "example": {"serviceId": 1, "displayName": "my-test-instance"}, }, }, }, diff --git a/site/routes/operations_routes.py b/site/routes/operations_routes.py index f0e01a6..2fc7495 100644 --- a/site/routes/operations_routes.py +++ b/site/routes/operations_routes.py @@ -237,6 +237,10 @@ def set_operation_param(): if not op_uid or param_id is None: return jsonify({"error": "instanceOperationUid and svcOperationCfsParamId required"}), 400 + # Валидация: svcOperationCfsParamId должен быть целым числом + if not isinstance(param_id, int) or isinstance(param_id, bool): + return jsonify({"error": "svcOperationCfsParamId must be an integer"}), 400 + # Проверка что операция существует if not state.get_operation(op_uid): return jsonify({"error": "operation not found"}), 404 diff --git a/site/routes/run.py b/site/routes/run.py index 3417ddf..abeb2f3 100644 --- a/site/routes/run.py +++ b/site/routes/run.py @@ -72,7 +72,7 @@ def run_operation(uid): # Применить эффект операции к состоянию инстанса # (create → running+params, delete → удалить, modify → мерж params, ...) - state_machine.apply_effect(uid, st, _cfg.SERVICES) + state_machine.apply_effect(uid, st, SERVICES) # Фиксируем время завершения — операция выполнена успешно op["dtFinish"] = _now() diff --git a/site/templates/swagger.html b/site/templates/swagger.html index 0ba4829..b9c8787 100644 --- a/site/templates/swagger.html +++ b/site/templates/swagger.html @@ -92,15 +92,15 @@ showCommonExtensions: true, // Предзаполняем токен для _mock/* onComplete: function () { - const authToken = "{{ auth_token }}"; + const authToken = {{ auth_token | tojson }}; if (authToken) { ui.preauthorizeApiKey("mockAuth", authToken); } }, requestInterceptor: function (req) { // Добавляем X-Mock-Auth только для _mock/* эндпоинтов - if (req.url.indexOf("/_mock/") !== -1 && "{{ auth_token }}") { - req.headers["X-Mock-Auth"] = "{{ auth_token }}"; + if (req.url.indexOf("/_mock/") !== -1 && {{ auth_token | tojson }}) { + req.headers["X-Mock-Auth"] = {{ auth_token | tojson }}; } return req; }, diff --git a/tests/fuzz_test.py b/tests/fuzz_test.py index 9946ab8..4582309 100644 --- a/tests/fuzz_test.py +++ b/tests/fuzz_test.py @@ -86,7 +86,7 @@ for sid in stands: json={"serviceId": -1, "displayName": "x"}, headers=H), 400)) t("serviceId=0", lambda: st(client.post(f"{base}/api/v1/svc/instances", - json={"serviceId": 0, "displayName": "x"}, headers=H), 404)) + json={"serviceId": 0, "displayName": "x"}, headers=H), 400)) t("displayName=число", lambda: st(client.post(f"{base}/api/v1/svc/instances", json={"serviceId": 1, "displayName": 12345}, headers=H), 201))