Skip to content

Commit bdf76f4

Browse files
CharStringsvenvandescheur
CharString
authored and
svenvandescheur
committed
🐛 fix: Coerce str query params to int etc
Apparently by default, only things like `uuid.UUID` and `datetime.date` are coerced, but not int. Since query params are always `str`, do the most lenient coercion possible.
1 parent 84d3f72 commit bdf76f4

7 files changed

+550
-13
lines changed

‎backend/src/openbeheer/api/views.py‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -162,14 +162,17 @@ def to_ob_field(name: str, annotation: type) -> OBField:
162162
def parse_query_params(self, request: Request, api_client: APIClient) -> P:
163163
"Parse incoming query parameters into a value of `self.query_type`"
164164

165-
# Sanitize params to prevent list values.
166165
# TODO: Figure out how to deal with intentional lists?
167-
params_dict = {
166+
# request.query_params: ⊑ ImmutableMapping[str, list[str]]
167+
params_dict: dict[str, str | None] = {
168168
key: request.query_params.get(key) for key in request.query_params
169169
}
170170

171-
# Parse sanitized params.
172-
params = convert(params_dict, self.query_type)
171+
params = convert(
172+
params_dict,
173+
self.query_type,
174+
strict=False, # allow all coercions str -> ...
175+
)
173176
return params
174177

175178
def get_data(

‎backend/src/openbeheer/zaaktype/tests/cassettes/ZaakTypeListViewTest.test_identificatie_filter.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
interactions:
2+
- request:
3+
body: null
4+
headers:
5+
Accept:
6+
- '*/*'
7+
Accept-Crs:
8+
- EPSG:4326
9+
Accept-Encoding:
10+
- gzip, deflate
11+
Authorization:
12+
- Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ0ZXN0LXZjciIsImlhdCI6MTc1MDE1NjM2OCwiZXhwIjoxNzUwMTk5NTY4LCJjbGllbnRfaWQiOiJ0ZXN0LXZjciIsInVzZXJfaWQiOiIiLCJ1c2VyX3JlcHJlc2VudGF0aW9uIjoiIn0.G03r4HUiIhfD-sp8E4k101fpPAFaMzJ6ijkSMTdd_dU
13+
Connection:
14+
- keep-alive
15+
User-Agent:
16+
- python-requests/2.32.4
17+
method: GET
18+
uri: http://localhost:8003/catalogi/api/v1/zaaktypen?pageSize=10&page=1&identificatie=ZAAKTYPE-2018-0000000001&status=alles
19+
response:
20+
body:
21+
string: '{"count":2,"next":null,"previous":null,"results":[{"url":"http://localhost:8003/catalogi/api/v1/zaaktypen/607ff443-d92e-4458-9f50-b93bad73e83c","identificatie":"ZAAKTYPE-2018-0000000001","omschrijving":"brand
22+
world-class initiatives","omschrijvingGeneriek":"","vertrouwelijkheidaanduiding":"openbaar","doel":"Trouble
23+
red compare produce animal. Everything today Democrat student enter. By probably
24+
adult.","aanleiding":"Couple toward trip old nice memory system instead.","toelichting":"","indicatieInternOfExtern":"extern","handelingInitiator":"indienen","onderwerp":"Evenementvergunning","handelingBehandelaar":"uitvoeren","doorlooptijd":"P30D","servicenorm":"P0D","opschortingEnAanhoudingMogelijk":true,"verlengingMogelijk":false,"verlengingstermijn":null,"trefwoorden":["foo","bar"],"publicatieIndicatie":true,"publicatietekst":"","verantwoordingsrelatie":[],"productenOfDiensten":["https://example.com/product/123"],"selectielijstProcestype":"https://selectielijst.openzaak.nl/api/v1/procestypen/e1b73b12-b2f6-4c4e-8929-94f84dd2a57d","referentieproces":{"naam":"ReferentieProces
25+
0","link":""},"concept":true,"verantwoordelijke":"100000000","beginGeldigheid":"2025-06-03","eindeGeldigheid":null,"versiedatum":"2025-06-03","beginObject":"2018-01-01","eindeObject":null,"catalogus":"http://localhost:8003/catalogi/api/v1/catalogussen/ec77ad39-0954-4aeb-bcf2-6f45263cde77","statustypen":["http://localhost:8003/catalogi/api/v1/statustypen/0ac81636-80f2-4864-8499-a9c947341d93"],"resultaattypen":["http://localhost:8003/catalogi/api/v1/resultaattypen/ed37e32c-f5da-483c-9592-13de9f32b755"],"eigenschappen":[],"informatieobjecttypen":["http://localhost:8003/catalogi/api/v1/informatieobjecttypen/a8089bdf-72d3-414f-a9cd-953cfa602b6c"],"roltypen":[],"besluittypen":["http://localhost:8003/catalogi/api/v1/besluittypen/588d7ec5-89e6-4aa0-a654-7475f0d5ac8e"],"deelzaaktypen":[],"gerelateerdeZaaktypen":[],"zaakobjecttypen":[]},{"url":"http://localhost:8003/catalogi/api/v1/zaaktypen/be210495-20b6-48ff-8d3d-3e44f74c43a4","identificatie":"ZAAKTYPE-2018-0000000001","omschrijving":"brand
26+
world-class initiatives","omschrijvingGeneriek":"","vertrouwelijkheidaanduiding":"","doel":"Trouble
27+
red compare produce animal. Everything today Democrat student enter. By probably
28+
adult.","aanleiding":"Couple toward trip old nice memory system instead.","toelichting":"","indicatieInternOfExtern":"extern","handelingInitiator":"indienen","onderwerp":"Evenementvergunning","handelingBehandelaar":"uitvoeren","doorlooptijd":"P30D","servicenorm":null,"opschortingEnAanhoudingMogelijk":true,"verlengingMogelijk":false,"verlengingstermijn":null,"trefwoorden":[],"publicatieIndicatie":true,"publicatietekst":"","verantwoordingsrelatie":[],"productenOfDiensten":["https://example.com/product/123"],"selectielijstProcestype":"https://selectielijst.openzaak.nl/api/v1/procestypen/aa8aa2fd-b9c6-4e34-9a6c-58a677f60ea0","referentieproces":{"naam":"ReferentieProces
29+
0","link":""},"concept":false,"verantwoordelijke":"100000000","beginGeldigheid":"2018-01-01","eindeGeldigheid":null,"versiedatum":"2018-01-01","beginObject":"2018-01-01","eindeObject":null,"catalogus":"http://localhost:8003/catalogi/api/v1/catalogussen/ec77ad39-0954-4aeb-bcf2-6f45263cde77","statustypen":["http://localhost:8003/catalogi/api/v1/statustypen/9438e56a-5d78-4dc8-9d9a-2404781f818d"],"resultaattypen":["http://localhost:8003/catalogi/api/v1/resultaattypen/12903100-b7a0-4441-9645-eda7df2ad106"],"eigenschappen":[],"informatieobjecttypen":["http://localhost:8003/catalogi/api/v1/informatieobjecttypen/a8089bdf-72d3-414f-a9cd-953cfa602b6c"],"roltypen":[],"besluittypen":["http://localhost:8003/catalogi/api/v1/besluittypen/588d7ec5-89e6-4aa0-a654-7475f0d5ac8e"],"deelzaaktypen":[],"gerelateerdeZaaktypen":[],"zaakobjecttypen":[]}]}'
30+
headers:
31+
API-version:
32+
- 1.3.1
33+
Allow:
34+
- GET, POST, HEAD, OPTIONS
35+
Connection:
36+
- keep-alive
37+
Content-Length:
38+
- '3778'
39+
Content-Security-Policy:
40+
- 'font-src ''self'' fonts.gstatic.com; object-src ''none''; connect-src ''self''
41+
raw.githubusercontent.com; script-src ''self'' ''unsafe-inline'' cdnjs.cloudflare.com
42+
cdn.jsdelivr.net; frame-ancestors ''none''; form-action ''self''; base-uri
43+
''self''; style-src ''self'' ''unsafe-inline'' fonts.googleapis.com cdnjs.cloudflare.com
44+
cdn.jsdelivr.net; worker-src ''self'' blob:; frame-src ''self''; img-src ''self''
45+
data: cdn.redoc.ly cdnjs.cloudflare.com tile.openstreetmap.org; default-src
46+
''self'''
47+
Content-Type:
48+
- application/json
49+
Cross-Origin-Opener-Policy:
50+
- same-origin
51+
Date:
52+
- Tue, 17 Jun 2025 10:32:48 GMT
53+
Referrer-Policy:
54+
- same-origin
55+
Server:
56+
- nginx/1.27.4
57+
Vary:
58+
- Accept, origin
59+
X-Content-Type-Options:
60+
- nosniff
61+
X-Frame-Options:
62+
- DENY
63+
status:
64+
code: 200
65+
message: OK
66+
version: 1

‎backend/src/openbeheer/zaaktype/tests/cassettes/ZaakTypeListViewTest.test_page_request.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
interactions:
2+
- request:
3+
body: null
4+
headers:
5+
Accept:
6+
- '*/*'
7+
Accept-Crs:
8+
- EPSG:4326
9+
Accept-Encoding:
10+
- gzip, deflate
11+
Authorization:
12+
- Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ0ZXN0LXZjciIsImlhdCI6MTc1MDE1NjM2OCwiZXhwIjoxNzUwMTk5NTY4LCJjbGllbnRfaWQiOiJ0ZXN0LXZjciIsInVzZXJfaWQiOiIiLCJ1c2VyX3JlcHJlc2VudGF0aW9uIjoiIn0.G03r4HUiIhfD-sp8E4k101fpPAFaMzJ6ijkSMTdd_dU
13+
Connection:
14+
- keep-alive
15+
User-Agent:
16+
- python-requests/2.32.4
17+
method: GET
18+
uri: http://localhost:8003/catalogi/api/v1/zaaktypen?pageSize=10&page=1&status=alles
19+
response:
20+
body:
21+
string: '{"count":5,"next":null,"previous":null,"results":[{"url":"http://localhost:8003/catalogi/api/v1/zaaktypen/607ff443-d92e-4458-9f50-b93bad73e83c","identificatie":"ZAAKTYPE-2018-0000000001","omschrijving":"brand
22+
world-class initiatives","omschrijvingGeneriek":"","vertrouwelijkheidaanduiding":"openbaar","doel":"Trouble
23+
red compare produce animal. Everything today Democrat student enter. By probably
24+
adult.","aanleiding":"Couple toward trip old nice memory system instead.","toelichting":"","indicatieInternOfExtern":"extern","handelingInitiator":"indienen","onderwerp":"Evenementvergunning","handelingBehandelaar":"uitvoeren","doorlooptijd":"P30D","servicenorm":"P0D","opschortingEnAanhoudingMogelijk":true,"verlengingMogelijk":false,"verlengingstermijn":null,"trefwoorden":["foo","bar"],"publicatieIndicatie":true,"publicatietekst":"","verantwoordingsrelatie":[],"productenOfDiensten":["https://example.com/product/123"],"selectielijstProcestype":"https://selectielijst.openzaak.nl/api/v1/procestypen/e1b73b12-b2f6-4c4e-8929-94f84dd2a57d","referentieproces":{"naam":"ReferentieProces
25+
0","link":""},"concept":true,"verantwoordelijke":"100000000","beginGeldigheid":"2025-06-03","eindeGeldigheid":null,"versiedatum":"2025-06-03","beginObject":"2018-01-01","eindeObject":null,"catalogus":"http://localhost:8003/catalogi/api/v1/catalogussen/ec77ad39-0954-4aeb-bcf2-6f45263cde77","statustypen":["http://localhost:8003/catalogi/api/v1/statustypen/0ac81636-80f2-4864-8499-a9c947341d93"],"resultaattypen":["http://localhost:8003/catalogi/api/v1/resultaattypen/ed37e32c-f5da-483c-9592-13de9f32b755"],"eigenschappen":[],"informatieobjecttypen":["http://localhost:8003/catalogi/api/v1/informatieobjecttypen/a8089bdf-72d3-414f-a9cd-953cfa602b6c"],"roltypen":[],"besluittypen":["http://localhost:8003/catalogi/api/v1/besluittypen/588d7ec5-89e6-4aa0-a654-7475f0d5ac8e"],"deelzaaktypen":[],"gerelateerdeZaaktypen":[],"zaakobjecttypen":[]},{"url":"http://localhost:8003/catalogi/api/v1/zaaktypen/ce9feadd-00cb-46c8-a0ef-1d1dfc78586a","identificatie":"ZAAKTYPE-2018-0000000002","omschrijving":"Destruction
26+
confirmation type","omschrijvingGeneriek":"","vertrouwelijkheidaanduiding":"","doel":"To
27+
confirm that a destruction list has been correctly processed.","aanleiding":"When
28+
a destructio list is processed by Open Archiefbeheer","toelichting":"","indicatieInternOfExtern":"extern","handelingInitiator":"indienen","onderwerp":"Destruction","handelingBehandelaar":"uitvoeren","doorlooptijd":"P30D","servicenorm":null,"opschortingEnAanhoudingMogelijk":true,"verlengingMogelijk":false,"verlengingstermijn":null,"trefwoorden":[],"publicatieIndicatie":true,"publicatietekst":"","verantwoordingsrelatie":[],"productenOfDiensten":["https://example.com/product/123"],"selectielijstProcestype":"https://selectielijst.openzaak.nl/api/v1/procestypen/c844637e-6393-4202-b030-e1bffb08a9b0","referentieproces":{"naam":"ReferentieProces
29+
0","link":""},"concept":false,"verantwoordelijke":"100000000","beginGeldigheid":"2025-03-21","eindeGeldigheid":null,"versiedatum":"2018-01-01","beginObject":"2018-01-01","eindeObject":null,"catalogus":"http://localhost:8003/catalogi/api/v1/catalogussen/ec77ad39-0954-4aeb-bcf2-6f45263cde77","statustypen":["http://localhost:8003/catalogi/api/v1/statustypen/835a2a13-f52f-4339-83e5-b7250e5ad016"],"resultaattypen":["http://localhost:8003/catalogi/api/v1/resultaattypen/5d39b8ac-437a-475c-9a76-0f6ae1540d0e"],"eigenschappen":[],"informatieobjecttypen":["http://localhost:8003/catalogi/api/v1/informatieobjecttypen/9dee6712-122e-464a-99a3-c16692de5485"],"roltypen":[],"besluittypen":[],"deelzaaktypen":[],"gerelateerdeZaaktypen":[],"zaakobjecttypen":[]},{"url":"http://localhost:8003/catalogi/api/v1/zaaktypen/ec9ebcdb-b652-466d-a651-fdb8ea787487","identificatie":"ZAAKTYPE-2020-0000000001","omschrijving":"Testing
30+
resultaattypen process","omschrijvingGeneriek":"","vertrouwelijkheidaanduiding":"","doel":"Trouble
31+
red compare produce animal. Everything today Democrat student enter. By probably
32+
adult.","aanleiding":"Couple toward trip old nice memory system instead.","toelichting":"","indicatieInternOfExtern":"extern","handelingInitiator":"indienen","onderwerp":"Evenementvergunning","handelingBehandelaar":"uitvoeren","doorlooptijd":"P30D","servicenorm":null,"opschortingEnAanhoudingMogelijk":true,"verlengingMogelijk":false,"verlengingstermijn":null,"trefwoorden":[],"publicatieIndicatie":true,"publicatietekst":"","verantwoordingsrelatie":[],"productenOfDiensten":["https://example.com/product/123"],"selectielijstProcestype":"https://selectielijst.openzaak.nl/api/v1/procestypen/aa8aa2fd-b9c6-4e34-9a6c-58a677f60ea0","referentieproces":{"naam":"ReferentieProces
33+
0","link":""},"concept":false,"verantwoordelijke":"100000000","beginGeldigheid":"2018-01-01","eindeGeldigheid":null,"versiedatum":"2018-01-01","beginObject":"2018-01-01","eindeObject":null,"catalogus":"http://localhost:8003/catalogi/api/v1/catalogussen/ec77ad39-0954-4aeb-bcf2-6f45263cde77","statustypen":[],"resultaattypen":["http://localhost:8003/catalogi/api/v1/resultaattypen/b9109699-67cd-4c2e-a2cf-76b311d40e25","http://localhost:8003/catalogi/api/v1/resultaattypen/7759dcb7-de9a-4543-99e3-81472c488f32"],"eigenschappen":[],"informatieobjecttypen":[],"roltypen":["http://localhost:8003/catalogi/api/v1/roltypen/ae39e60c-0e4b-4432-a830-8755ed083fda"],"besluittypen":[],"deelzaaktypen":[],"gerelateerdeZaaktypen":[],"zaakobjecttypen":[]},{"url":"http://localhost:8003/catalogi/api/v1/zaaktypen/ecd08880-5081-4d7a-afc3-ade1d6e6346f","identificatie":"ZAAKTYPE-2018-0000000002","omschrijving":"Destruction
34+
confirmation type","omschrijvingGeneriek":"","vertrouwelijkheidaanduiding":"","doel":"To
35+
confirm that a destruction list has been correctly processed.","aanleiding":"When
36+
a destructio list is processed by Open Archiefbeheer","toelichting":"","indicatieInternOfExtern":"extern","handelingInitiator":"indienen","onderwerp":"Destruction","handelingBehandelaar":"uitvoeren","doorlooptijd":"P30D","servicenorm":null,"opschortingEnAanhoudingMogelijk":true,"verlengingMogelijk":false,"verlengingstermijn":null,"trefwoorden":[],"publicatieIndicatie":true,"publicatietekst":"","verantwoordingsrelatie":[],"productenOfDiensten":["https://example.com/product/123"],"selectielijstProcestype":"https://selectielijst.openzaak.nl/api/v1/procestypen/c844637e-6393-4202-b030-e1bffb08a9b0","referentieproces":{"naam":"ReferentieProces
37+
0","link":""},"concept":false,"verantwoordelijke":"100000000","beginGeldigheid":"2018-01-01","eindeGeldigheid":"2025-03-20","versiedatum":"2018-01-01","beginObject":"2018-01-01","eindeObject":null,"catalogus":"http://localhost:8003/catalogi/api/v1/catalogussen/ec77ad39-0954-4aeb-bcf2-6f45263cde77","statustypen":[],"resultaattypen":[],"eigenschappen":[],"informatieobjecttypen":[],"roltypen":[],"besluittypen":[],"deelzaaktypen":[],"gerelateerdeZaaktypen":[],"zaakobjecttypen":[]},{"url":"http://localhost:8003/catalogi/api/v1/zaaktypen/be210495-20b6-48ff-8d3d-3e44f74c43a4","identificatie":"ZAAKTYPE-2018-0000000001","omschrijving":"brand
38+
world-class initiatives","omschrijvingGeneriek":"","vertrouwelijkheidaanduiding":"","doel":"Trouble
39+
red compare produce animal. Everything today Democrat student enter. By probably
40+
adult.","aanleiding":"Couple toward trip old nice memory system instead.","toelichting":"","indicatieInternOfExtern":"extern","handelingInitiator":"indienen","onderwerp":"Evenementvergunning","handelingBehandelaar":"uitvoeren","doorlooptijd":"P30D","servicenorm":null,"opschortingEnAanhoudingMogelijk":true,"verlengingMogelijk":false,"verlengingstermijn":null,"trefwoorden":[],"publicatieIndicatie":true,"publicatietekst":"","verantwoordingsrelatie":[],"productenOfDiensten":["https://example.com/product/123"],"selectielijstProcestype":"https://selectielijst.openzaak.nl/api/v1/procestypen/aa8aa2fd-b9c6-4e34-9a6c-58a677f60ea0","referentieproces":{"naam":"ReferentieProces
41+
0","link":""},"concept":false,"verantwoordelijke":"100000000","beginGeldigheid":"2018-01-01","eindeGeldigheid":null,"versiedatum":"2018-01-01","beginObject":"2018-01-01","eindeObject":null,"catalogus":"http://localhost:8003/catalogi/api/v1/catalogussen/ec77ad39-0954-4aeb-bcf2-6f45263cde77","statustypen":["http://localhost:8003/catalogi/api/v1/statustypen/9438e56a-5d78-4dc8-9d9a-2404781f818d"],"resultaattypen":["http://localhost:8003/catalogi/api/v1/resultaattypen/12903100-b7a0-4441-9645-eda7df2ad106"],"eigenschappen":[],"informatieobjecttypen":["http://localhost:8003/catalogi/api/v1/informatieobjecttypen/a8089bdf-72d3-414f-a9cd-953cfa602b6c"],"roltypen":[],"besluittypen":["http://localhost:8003/catalogi/api/v1/besluittypen/588d7ec5-89e6-4aa0-a654-7475f0d5ac8e"],"deelzaaktypen":[],"gerelateerdeZaaktypen":[],"zaakobjecttypen":[]}]}'
42+
headers:
43+
API-version:
44+
- 1.3.1
45+
Allow:
46+
- GET, POST, HEAD, OPTIONS
47+
Connection:
48+
- keep-alive
49+
Content-Length:
50+
- '8732'
51+
Content-Security-Policy:
52+
- 'font-src ''self'' fonts.gstatic.com; object-src ''none''; connect-src ''self''
53+
raw.githubusercontent.com; script-src ''self'' ''unsafe-inline'' cdnjs.cloudflare.com
54+
cdn.jsdelivr.net; frame-ancestors ''none''; form-action ''self''; base-uri
55+
''self''; style-src ''self'' ''unsafe-inline'' fonts.googleapis.com cdnjs.cloudflare.com
56+
cdn.jsdelivr.net; worker-src ''self'' blob:; frame-src ''self''; img-src ''self''
57+
data: cdn.redoc.ly cdnjs.cloudflare.com tile.openstreetmap.org; default-src
58+
''self'''
59+
Content-Type:
60+
- application/json
61+
Cross-Origin-Opener-Policy:
62+
- same-origin
63+
Date:
64+
- Tue, 17 Jun 2025 10:32:48 GMT
65+
Referrer-Policy:
66+
- same-origin
67+
Server:
68+
- nginx/1.27.4
69+
Vary:
70+
- Accept, origin
71+
X-Content-Type-Options:
72+
- nosniff
73+
X-Frame-Options:
74+
- DENY
75+
status:
76+
code: 200
77+
message: OK
78+
version: 1

0 commit comments

Comments
 (0)