kinto 19.3.0__tar.gz → 19.3.1__tar.gz

{kinto-19.3.0/kinto.egg-info → kinto-19.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: kinto
-Version: 19.3.0
+Version: 19.3.1
 Summary: Kinto Web Service - Store, Sync, Share, and Self-Host.
 Author-email: Mozilla Services <developers@kinto-storage.org>
 License: Copyright 2012 - Mozilla Foundation

{kinto-19.3.0 → kinto-19.3.1}/constraints.txt

@@ -10,7 +10,7 @@ attrs==23.2.0
     # via
     #   jsonschema
     #   referencing
-bcrypt==4.2.0
+bcrypt==4.2.1
     # via -r constraints.in
 beautifulsoup4==4.12.3
     # via webtest
@@ -36,7 +36,7 @@ cornice==6.0.1
     #   cornice-swagger
 cornice-swagger==1.0.1
     # via -r constraints.in
-coverage==7.4.0
+coverage==7.6.4
     # via pytest-cov
 dockerflow==2024.4.2
     # via -r constraints.in
@@ -81,7 +81,7 @@ markupsafe==2.1.4
     # via werkzeug
 msgpack==1.0.7
     # via bravado-core
-newrelic==10.2.0
+newrelic==10.3.1
     # via -r constraints.in
 packaging==23.2
     # via
@@ -96,11 +96,11 @@ plaster==1.1.2
     #   pyramid
 plaster-pastedeploy==1.0.1
     # via pyramid
-playwright==1.48.0
+playwright==1.49.0
     # via -r constraints.in
 pluggy==1.5.0
     # via pytest
-prometheus-client==0.21.0
+prometheus-client==0.21.1
     # via -r constraints.in
 psycopg2==2.9.10
     # via -r constraints.in
@@ -119,16 +119,16 @@ pyramid-mailer==0.15.1
     # via -r constraints.in
 pyramid-multiauth==1.0.2
     # via -r constraints.in
-pyramid-tm==2.5
+pyramid-tm==2.6
     # via -r constraints.in
-pytest==8.3.3
+pytest==8.3.4
     # via
     #   -r constraints.in
     #   pytest-cache
     #   pytest-cov
 pytest-cache==1.0
     # via -r constraints.in
-pytest-cov==5.0.0
+pytest-cov==6.0.0
     # via -r constraints.in
 python-dateutil==2.9.0.post0
     # via
@@ -163,7 +163,7 @@ rpds-py==0.17.1
     # via
     #   jsonschema
     #   referencing
-ruff==0.7.1
+ruff==0.8.2
     # via -r constraints.in
 sentry-sdk==2.8.0
     # via -r constraints.in
@@ -214,7 +214,7 @@ venusian==3.1.0
     # via
     #   cornice
     #   pyramid
-waitress==3.0.1
+waitress==3.0.2
     # via
     #   -r constraints.in
     #   webtest
@@ -226,7 +226,7 @@ webob==1.8.8
     #   webtest
 webtest==3.0.0
     # via -r constraints.in
-werkzeug==3.0.6
+werkzeug==3.1.3
     # via -r constraints.in
 zope-deprecation==5.0
     # via pyramid

{kinto-19.3.0 → kinto-19.3.1}/docs/requirements.txt

@@ -1,11 +1,11 @@
 Sphinx==8.1.3
-sphinx_rtd_theme==3.0.1
+sphinx_rtd_theme==3.0.2
 docutils==0.20.1
 sphinxcontrib-httpdomain==1.8.1
 sphinx-github-changelog==1.4.0
 kinto
 mock==5.1.0
-webtest==3.0.1
+webtest==3.0.2
 cornice==6.1.0
 pyramid==2.0.2
 python-rapidjson==1.20

{kinto-19.3.0 → kinto-19.3.1}/kinto/core/initialization.py

@@ -1,6 +1,7 @@
 import logging
 import random
 import re
+import urllib.parse
 import warnings
 from datetime import datetime
 from secrets import token_hex
@@ -474,6 +475,7 @@ def setup_metrics(config):
 
         try:
             endpoint = utils.strip_uri_prefix(request.path)
+            endpoint = urllib.parse.quote_plus(endpoint, safe="/?&=-_")
         except UnicodeDecodeError as e:
             # This `on_new_response` callback is also called when a HTTP 400
             # is returned because of an invalid UTF-8 path. We still want metrics.
@@ -507,7 +509,7 @@ def setup_metrics(config):
             unique=[
                 ("method", request.method.lower()),
                 ("endpoint", endpoint),
-                ("status", str(request.response.status_code)),
+                ("status", str(event.response.status_code)),
             ]
             + metrics_matchdict_labels,
         )
@@ -527,7 +529,7 @@ def setup_metrics(config):
         # Observe response size.
         metrics_service.observe(
             "request_size",
-            len(request.response.body or b""),
+            len(event.response.body or b""),
             labels=[("endpoint", endpoint)] + metrics_matchdict_labels,
         )
 

{kinto-19.3.0 → kinto-19.3.1}/kinto/core/resource/__init__.py

@@ -665,7 +665,7 @@ class Resource:
         obj = self._get_object_or_404(self.object_id)
         self._raise_412_if_modified(obj)
 
-        # Retreive the last_modified information from a querystring if present.
+        # Retrieve the last_modified information from a querystring if present.
         last_modified = self.request.validated["querystring"].get("last_modified")
 
         # If less or equal than current object. Ignore it.
@@ -1060,7 +1060,8 @@ class Resource:
         """Extracts filters from QueryString parameters."""
 
         def is_valid_timestamp(value):
-            return isinstance(value, int) or re.match(r'^"?\d+"?$', str(value))
+            # Is either integer, or integer as string, or integer between 2 quotes.
+            return isinstance(value, int) or re.match(r'^(\d+)$|^("\d+")$', str(value))
 
         queryparams = self.request.validated["querystring"]
 

{kinto-19.3.0 → kinto-19.3.1}/kinto/plugins/statsd.py

@@ -13,6 +13,14 @@ except ImportError:  # pragma: no cover
     statsd_module = None
 
 
+def sanitize(value):
+    """
+    Telegraf does not support ':' in values.
+    See https://github.com/influxdata/telegraf/issues/4495
+    """
+    return value.replace(":", "") if isinstance(value, str) else value
+
+
 @implementer(metrics.IMetricsService)
 class StatsDService:
     def __init__(self, host, port, prefix):
@@ -22,7 +30,7 @@ class StatsDService:
         return self._client.timer(key)
 
     def observe(self, key, value, labels=[]):
-        return self._client.gauge(key, value)
+        return self._client.gauge(key, sanitize(value))
 
     def count(self, key, count=1, unique=None):
         if unique is None:
@@ -30,7 +38,7 @@ class StatsDService:
         if isinstance(unique, list):
             # [("method", "get")] -> "method.get"
             # [("endpoint", "/"), ("method", "get")] -> "endpoint./.method.get"
-            unique = ".".join(f"{label[0]}.{label[1]}" for label in unique)
+            unique = ".".join(f"{label[0]}.{sanitize(label[1])}" for label in unique)
         else:
             warnings.warn(
                 "`unique` parameter should be of type ``list[tuple[str, str]]``",

{kinto-19.3.0 → kinto-19.3.1/kinto.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: kinto
-Version: 19.3.0
+Version: 19.3.1
 Summary: Kinto Web Service - Store, Sync, Share, and Self-Host.
 Author-email: Mozilla Services <developers@kinto-storage.org>
 License: Copyright 2012 - Mozilla Foundation

{kinto-19.3.0 → kinto-19.3.1}/tests/core/resource/test_filter.py

@@ -92,6 +92,10 @@ class FilteringTest(BaseTest):
         self.validated["querystring"] = {"lt_last_modified": bad_value}
         self.assertRaises(httpexceptions.HTTPBadRequest, self.resource.plural_get)
 
+    def test_filter_raises_error_if_last_modified_value_has_malformed_quotes(self):
+        self.validated["querystring"] = {"last_modified": '123"'}
+        self.assertRaises(httpexceptions.HTTPBadRequest, self.resource.plural_get)
+
     def test_filter_works_with_since_none(self):
         self.validated["querystring"] = {"_since": None}
         result = self.resource.plural_get()

{kinto-19.3.0 → kinto-19.3.1}/tests/core/test_initialization.py

@@ -420,6 +420,25 @@ class MetricsConfigurationTest(unittest.TestCase):
             unique=[("method", "get"), ("endpoint", "/__heartbeat__"), ("status", "200")],
         )
 
+    def test_statsd_sanitizes_url_in_metrics(self):
+        kinto.core.initialize(self.config, "0.0.1", "settings_prefix")
+        app = webtest.TestApp(self.config.make_wsgi_app())
+        app.get(
+            "/v0/changeset'%7C%22%3F%3E%3C!DOCTYPE%22http://xh3E'),'/l')%20from%20dual)%7C'",
+            status=404,
+        )
+        self.mocked().count.assert_any_call(
+            "request_summary",
+            unique=[
+                ("method", "get"),
+                (
+                    "endpoint",
+                    "/changeset%27%257C%2522%253F%253E%253C%21DOCTYPE%2522http%3A//xh3E%27%29%2C%27/l%27%29%2520from%2520dual%29%257C%27",
+                ),
+                ("status", "404"),
+            ],
+        )
+
     def test_statsd_observe_request_size(self):
         kinto.core.initialize(self.config, "0.0.1", "settings_prefix")
         app = webtest.TestApp(self.config.make_wsgi_app())

{kinto-19.3.0 → kinto-19.3.1}/tests/plugins/test_statsd.py

@@ -61,6 +61,11 @@ class StatsdClientTest(unittest.TestCase):
             self.client.count("click", unique=[("component", "menu"), ("sound", "off")])
             mocked_client.set.assert_called_with("click", "component.menu.sound.off")
 
+    def test_values_are_sanitized(self):
+        with mock.patch.object(self.client, "_client") as mocked_client:
+            self.client.count("click", unique=[("user", "account:boss")])
+            mocked_client.set.assert_called_with("click", "user.accountboss")
+
     @mock.patch("kinto.plugins.statsd.statsd_module")
     def test_load_from_config(self, module_mock):
         config = testing.setUp()