[fix] Validate Config.context and Template.default_values

Config.context and Template.default_values must always be a dictionary.
Falsy values will be converted to empty dictionary automatically.

Author: nemesifier

openwisp_controller/config/base/config.py

@@ -253,10 +253,17 @@ def get_default_templates(self):
 
     def clean(self):
         """
-        modifies status if key attributes of the configuration
-        have changed (queries the database)
+        * validates context field
+        * modifies status if key attributes of the configuration
+          have changed (queries the database)
         """
         super().clean()
+        if not self.context:
+            self.context = {}
+        if not isinstance(self.context, dict):
+            raise ValidationError(
+                {'context': _('the supplied value is not a JSON object')}
+            )
         if self._state.adding:
             return
         current = self.__class__.objects.get(pk=self.pk)

openwisp_controller/config/base/template.py

@@ -129,11 +129,19 @@ def _update_related_config_status(self):
 
     def clean(self, *args, **kwargs):
         """
+        * validates org relationship of VPN if present
+        * validates default_values field
         * ensures VPN is selected if type is VPN
         * clears VPN specific fields if type is not VPN
         * automatically determines configuration if necessary
         """
         self._validate_org_relation('vpn')
+        if not self.default_values:
+            self.default_values = {}
+        if not isinstance(self.default_values, dict):
+            raise ValidationError(
+                {'default_values': _('the supplied value is not a JSON object')}
+            )
         if self.type == 'vpn' and not self.vpn:
             raise ValidationError(
                 {'vpn': _('A VPN must be selected when template type is "VPN"')}

openwisp_controller/config/tests/test_config.py

@@ -203,6 +203,32 @@ def test_config_context(self):
         self.assertIn(c.device.name, output)
         self.assertIn(c.device.mac_address, output)
 
+    def test_context_validation(self):
+        config = Config(
+            device=self._create_device(name='context-test'),
+            backend='netjsonconfig.OpenWrt',
+            config={},
+        )
+
+        for value in [None, '', False]:
+            with self.subTest(f'testing {value} in config.context'):
+                config.context = value
+                config.full_clean()
+                self.assertEqual(config.context, {})
+
+        for value in [['a', 'b'], '"test"']:
+            with self.subTest(
+                f'testing {value} in config.context, expecting validation error'
+            ):
+                config.context = value
+                with self.assertRaises(ValidationError) as context_manager:
+                    config.full_clean()
+                message_dict = context_manager.exception.message_dict
+                self.assertIn('context', message_dict)
+                self.assertIn(
+                    'the supplied value is not a JSON object', message_dict['context']
+                )
+
     def test_context_setting(self):
         config = {'general': {'vpnserver1': '{{ vpnserver1 }}'}}
         c = Config(

openwisp_controller/config/tests/test_template.py

@@ -292,6 +292,32 @@ def test_variable_substition(self):
         obj = Template.objects.get(name='test1')
         self.assertEqual(obj.name, 'test1')
 
+    def test_default_value_validation(self):
+        options = {
+            'name': 'test1',
+            'backend': 'netjsonconfig.OpenWrt',
+            'config': {},
+        }
+        template = Template(**options)
+
+        for value in [None, '', False]:
+            with self.subTest(f'testing {value} in template.default_values'):
+                template.default_values = value
+                template.full_clean()
+                self.assertEqual(template.default_values, {})
+
+        for value in [['a', 'b'], '"test"']:
+            with self.subTest(f'testing {value} in template.default_values'):
+                template.default_values = value
+                with self.assertRaises(ValidationError) as context_manager:
+                    template.full_clean()
+                message_dict = context_manager.exception.message_dict
+                self.assertIn('default_values', message_dict)
+                self.assertIn(
+                    'the supplied value is not a JSON object',
+                    message_dict['default_values'],
+                )
+
     def test_template_with_org(self):
         org = self._get_org()
         template = self._create_template(organization=org)