From 647d0c8a6d8d735e731655b6894603aba67327c4 Mon Sep 17 00:00:00 2001 From: Qixiang Wan Date: Jun 15 2018 03:03:57 +0000 Subject: Skip validation against package names This is a follow up fix to 5ce6431, validate_json_data should take the key as last_dict_key too when item is list. --- diff --git a/server/odcs/server/api_utils.py b/server/odcs/server/api_utils.py index 3cebdfd..f6023d6 100644 --- a/server/odcs/server/api_utils.py +++ b/server/odcs/server/api_utils.py @@ -164,7 +164,7 @@ def validate_json_data(dict_or_list, level=0, last_dict_key=None): "Only 'source' key is allowed to contain dict.") validate_json_data(v, level + 1, k) elif isinstance(v, list): - validate_json_data(v, level + 1) + validate_json_data(v, level + 1, k) elif isinstance(v, six.string_types): # Packages are stored in comps.xml, not in pungi.conf, so it is # not exploitable.