From a8889253a47060ec6613659116e2a6c74436227e Mon Sep 17 00:00:00 2001 From: Adam Dangoor Date: Sun, 16 Aug 2026 14:02:39 +0100 Subject: [PATCH] Reject non-object JSON request bodies --- src/mock_vws/_services_validators/json_validators.py | 8 +++++++- tests/mock_vws/test_invalid_json.py | 9 ++++++--- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/src/mock_vws/_services_validators/json_validators.py b/src/mock_vws/_services_validators/json_validators.py index 4e0549cd0..6174920b8 100644 --- a/src/mock_vws/_services_validators/json_validators.py +++ b/src/mock_vws/_services_validators/json_validators.py @@ -61,9 +61,15 @@ def validate_json(*, request_body: bytes, request_path: str) -> None: return try: - json.loads(s=request_body.decode()) + request_json = json.loads(s=request_body.decode()) except JSONDecodeError as exc: _LOGGER.warning(msg="The request body is not valid JSON.") if request_path.endswith("/instances"): raise BadRequestError from exc raise FailError(status_code=HTTPStatus.BAD_REQUEST) from exc + + if not isinstance(request_json, dict): + _LOGGER.warning(msg="The request body is not a JSON object.") + if request_path.endswith("/instances"): + raise BadRequestError + raise FailError(status_code=HTTPStatus.BAD_REQUEST) diff --git a/tests/mock_vws/test_invalid_json.py b/tests/mock_vws/test_invalid_json.py index 35b3253cd..3a9976881 100644 --- a/tests/mock_vws/test_invalid_json.py +++ b/tests/mock_vws/test_invalid_json.py @@ -26,9 +26,12 @@ class TestInvalidJSON: """Tests for giving invalid JSON to endpoints.""" @staticmethod - def test_invalid_json(endpoint: Endpoint) -> None: - """Giving invalid JSON to endpoints returns error responses.""" - content = b"a" + @pytest.mark.parametrize( + argnames="content", + argvalues=[b"a", b"[]", b'"hello"', b"5", b"null", b"true"], + ) + def test_invalid_json(endpoint: Endpoint, content: bytes) -> None: + """Giving invalid or non-object JSON returns error responses.""" gmt = ZoneInfo(key="GMT") now = datetime.now(tz=gmt) time_to_freeze = now