fides icon indicating copy to clipboard operation
fides copied to clipboard

Missing Validation In Messaging Configuration Inputs

Open RobertKeyser opened this issue 2 years ago • 1 comments

Bug Description

The input for the details of Messaging config does not validate input. For example, the following payloads to /api/v1/messaging/default are not validated and are allowed to be submitted:

mailgun - an invalid domain name may be passed

{
    "service_type": "mailgun",
    "details": {
        "domain": "this is an invalid domain" 
    }
}

sendgrid - an invalid email (here, just a domain name without an address) may be passed.

{
    "service_type": "twilio_email",
    "details": {
        "twilio_email_from": "example.com"
    }
}

Steps to Reproduce

  1. Launch an instance of Fides
  2. Try to create a twilio_email messaging configuration, but pass in a domain name instead of an email address
  3. Send a test email and receive an error

Expected behavior

Instead of creating the resource, the Fides webserver should return a 400 error.

Screenshots

If applicable, add screenshots to help explain your problem.

Environment

  • Version:
  • OS:
  • Python Version:
  • Docker Version:

Additional context

I discovered this issue when I accidentally passed a domain name to the twilio_email_from field instead of an email. Fides allowed the input and then when I went to send a test email, I received the following error: There was an error sending the test message: Email failed to send due to: HTTP Error 400: Bad Request. The subsequent error message appears to be caused by passing an invalid from email to Sendgrid.

RobertKeyser avatar Apr 13 '23 15:04 RobertKeyser

@Roger-Ethyca can we confirm if this is still an issue? Will file a bug in PROD if so.

rsilvery avatar Oct 20 '23 15:10 rsilvery