Skip to content

fix: handle invalid UUID in remove_self to prevent 500 and return 400 #5776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ashnaaseth2325-oss wants to merge 3 commits into
base: unstable
Choose a base branch
from
+7 −0
Open

fix: handle invalid UUID in remove_self to prevent 500 and return 400 #5776

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d9b736
fix: catch ValueError for malformed channel_id in remove_self
ashnaaseth2325-oss Mar 23, 2026
38c5afc
fix: validate channel_id as UUID before querying in remove_self
ashnaaseth2325-oss Mar 24, 2026
4ba11d0
[pre-commit.ci lite] apply automatic fixes
pre-commit-ci-lite[bot] Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions contentcuration/contentcuration/viewsets/user.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
import uuid
from functools import reduce

from django.db import IntegrityError
Expand Down Expand Up @@ -311,11 +312,17 @@ def remove_self(self, request, pk=None):

if not channel_id:
return HttpResponseBadRequest("Channel ID is required.")
try:
uuid.UUID(channel_id)
except ValueError:
return HttpResponseBadRequest("Invalid channel ID")

try:
channel = Channel.objects.get(id=channel_id)
except Channel.DoesNotExist:
return HttpResponseNotFound("Channel not found {}".format(channel_id))
except ValueError:
return HttpResponseBadRequest("Invalid channel ID: {}".format(channel_id))
Copy link
Copy Markdown
Member

@bjester bjester Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we still need this now? Or is it dead code?


if request.user != user and not request.user.can_edit(channel_id):
return HttpResponseForbidden(
Expand Down
Loading