{"action":"created","comment":{"url":"https://api.github.com/repos/mozilla/trunion/pulls/comments/24178893","id":24178893,"diff_hunk":"@@ -87,11 +95,47 @@ def valid_product(obj):\n         raise HTTPBadRequest(\"Invalid product struct: URL doesn't look like \"\n                              \"http://, https:// or app://: \\\"%s\\\"\" % obj['url'])\n     if len(obj['storedata']) < 1:\n-        raise HTTPBadRequest('Invalid product struct: storedata appears to be empty')\n+        raise HTTPBadRequest('Invalid product struct: storedata appears to be '\n+                             'empty')\n     return True\n \n \n def valid_app(request):\n     \"\"\"\n+    Not much validating to do, really.  So much validation is done by the\n+    separate validation service that we rely pretty heavily on the client\n+    end of this request doing its job.\n+    \"\"\"\n+    return True\n+\n+\n+def valid_addon(request):\n     \"\"\"\n+    Since the addon_id parameter could possibly be anything we can't do much\n+    to validate it.  At the moment a reasonable bounds check on length is\n+    about all I'm certain is acceptable.\n+\n+    We can use the signing_clients signature parser to at least make sure the\n+    signature is nominally correctly formatted.\n+    \"\"\"\n+    if 'addon_id' not in request.POST:\n+        raise HTTPBadRequest('missing addon identifier')\n+\n+    if 'file' not in request.POST:\n+        raise HTTPBadRequest('no payload to sign')\n+\n+    if len(request.POST['addon_id']) < 4:\n+        raise HTTPBadRequest('addon_id is very short(<4 bytes): \"%s\"'\n+                             % request.POST['addon_id'])\n+\n+    if len(request.POST['addon_id']) > 128:","path":"trunion/validators.py","position":78,"original_position":78,"commit_id":"c1167b2c4aab951828ee02bd73f04da38545a054","original_commit_id":"c1167b2c4aab951828ee02bd73f04da38545a054","user":{"login":"kumar303","id":55398,"avatar_url":"https://avatars.githubusercontent.com/u/55398?v=3","gravatar_id":"","url":"https://api.github.com/users/kumar303","html_url":"https://github.com/kumar303","followers_url":"https://api.github.com/users/kumar303/followers","following_url":"https://api.github.com/users/kumar303/following{/other_user}","gists_url":"https://api.github.com/users/kumar303/gists{/gist_id}","starred_url":"https://api.github.com/users/kumar303/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kumar303/subscriptions","organizations_url":"https://api.github.com/users/kumar303/orgs","repos_url":"https://api.github.com/users/kumar303/repos","events_url":"https://api.github.com/users/kumar303/events{/privacy}","received_events_url":"https://api.github.com/users/kumar303/received_events","type":"User","site_admin":false},"body":"good call on adding this check","created_at":"2015-02-05T17:07:13Z","updated_at":"2015-02-05T17:07:13Z","html_url":"https://github.com/mozilla/trunion/pull/12#discussion_r24178893","pull_request_url":"https://api.github.com/repos/mozilla/trunion/pulls/12","_links":{"self":{"href":"https://api.github.com/repos/mozilla/trunion/pulls/comments/24178893"},"html":{"href":"https://github.com/mozilla/trunion/pull/12#discussion_r24178893"},"pull_request":{"href":"https://api.github.com/repos/mozilla/trunion/pulls/12"}}},"pull_request":{"url":"https://api.github.com/repos/mozilla/trunion/pulls/12","id":28497184,"html_url":"https://github.com/mozilla/trunion/pull/12","diff_url":"https://github.com/mozilla/trunion/pull/12.diff","patch_url":"https://github.com/mozilla/trunion/pull/12.patch","issue_url":"https://api.github.com/repos/mozilla/trunion/issues/12","number":12,"state":"open","locked":false,"title":"Merge the addon signing additions","user":{"login":"rtilder","id":250074,"avatar_url":"https://avatars.githubusercontent.com/u/250074?v=3","gravatar_id":"","url":"https://api.github.com/users/rtilder","html_url":"https://github.com/rtilder","followers_url":"https://api.github.com/users/rtilder/followers","following_url":"https://api.github.com/users/rtilder/following{/other_user}","gists_url":"https://api.github.com/users/rtilder/gists{/gist_id}","starred_url":"https://api.github.com/users/rtilder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtilder/subscriptions","organizations_url":"https://api.github.com/users/rtilder/orgs","repos_url":"https://api.github.com/users/rtilder/repos","events_url":"https://api.github.com/users/rtilder/events{/privacy}","received_events_url":"https://api.github.com/users/rtilder/received_events","type":"User","site_admin":false},"body":"Also includes the flake8 tidying from last year.","created_at":"2015-02-02T19:52:48Z","updated_at":"2015-02-05T17:07:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"9f8944398b46a509945a5859abd2fa514583e698","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/mozilla/trunion/pulls/12/commits","review_comments_url":"https://api.github.com/repos/mozilla/trunion/pulls/12/comments","review_comment_url":"https://api.github.com/repos/mozilla/trunion/pulls/comments/{number}","comments_url":"https://api.github.com/repos/mozilla/trunion/issues/12/comments","statuses_url":"https://api.github.com/repos/mozilla/trunion/statuses/c1167b2c4aab951828ee02bd73f04da38545a054","head":{"label":"mozilla:rtilder/addon-signing","ref":"rtilder/addon-signing","sha":"c1167b2c4aab951828ee02bd73f04da38545a054","user":{"login":"mozilla","id":131524,"avatar_url":"https://avatars.githubusercontent.com/u/131524?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla","html_url":"https://github.com/mozilla","followers_url":"https://api.github.com/users/mozilla/followers","following_url":"https://api.github.com/users/mozilla/following{/other_user}","gists_url":"https://api.github.com/users/mozilla/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla/subscriptions","organizations_url":"https://api.github.com/users/mozilla/orgs","repos_url":"https://api.github.com/users/mozilla/repos","events_url":"https://api.github.com/users/mozilla/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla/received_events","type":"Organization","site_admin":false},"repo":{"id":4150376,"name":"trunion","full_name":"mozilla/trunion","owner":{"login":"mozilla","id":131524,"avatar_url":"https://avatars.githubusercontent.com/u/131524?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla","html_url":"https://github.com/mozilla","followers_url":"https://api.github.com/users/mozilla/followers","following_url":"https://api.github.com/users/mozilla/following{/other_user}","gists_url":"https://api.github.com/users/mozilla/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla/subscriptions","organizations_url":"https://api.github.com/users/mozilla/orgs","repos_url":"https://api.github.com/users/mozilla/repos","events_url":"https://api.github.com/users/mozilla/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla/trunion","description":"Receipt signing","fork":false,"url":"https://api.github.com/repos/mozilla/trunion","forks_url":"https://api.github.com/repos/mozilla/trunion/forks","keys_url":"https://api.github.com/repos/mozilla/trunion/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla/trunion/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla/trunion/teams","hooks_url":"https://api.github.com/repos/mozilla/trunion/hooks","issue_events_url":"https://api.github.com/repos/mozilla/trunion/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla/trunion/events","assignees_url":"https://api.github.com/repos/mozilla/trunion/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla/trunion/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla/trunion/tags","blobs_url":"https://api.github.com/repos/mozilla/trunion/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla/trunion/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla/trunion/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla/trunion/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla/trunion/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla/trunion/languages","stargazers_url":"https://api.github.com/repos/mozilla/trunion/stargazers","contributors_url":"https://api.github.com/repos/mozilla/trunion/contributors","subscribers_url":"https://api.github.com/repos/mozilla/trunion/subscribers","subscription_url":"https://api.github.com/repos/mozilla/trunion/subscription","commits_url":"https://api.github.com/repos/mozilla/trunion/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla/trunion/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla/trunion/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla/trunion/issues/comments/{number}","contents_url":"https://api.github.com/repos/mozilla/trunion/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla/trunion/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla/trunion/merges","archive_url":"https://api.github.com/repos/mozilla/trunion/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla/trunion/downloads","issues_url":"https://api.github.com/repos/mozilla/trunion/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla/trunion/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla/trunion/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla/trunion/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla/trunion/labels{/name}","releases_url":"https://api.github.com/repos/mozilla/trunion/releases{/id}","created_at":"2012-04-26T17:48:47Z","updated_at":"2014-07-24T21:13:54Z","pushed_at":"2015-02-05T17:01:37Z","git_url":"git://github.com/mozilla/trunion.git","ssh_url":"git@github.com:mozilla/trunion.git","clone_url":"https://github.com/mozilla/trunion.git","svn_url":"https://github.com/mozilla/trunion","homepage":"https://wiki.mozilla.org/Apps/WebApplicationReceipt/SigningService","size":312,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":1,"default_branch":"master"}},"base":{"label":"mozilla:master","ref":"master","sha":"8011e5347e55da62355e533be8d1c67338dda3cd","user":{"login":"mozilla","id":131524,"avatar_url":"https://avatars.githubusercontent.com/u/131524?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla","html_url":"https://github.com/mozilla","followers_url":"https://api.github.com/users/mozilla/followers","following_url":"https://api.github.com/users/mozilla/following{/other_user}","gists_url":"https://api.github.com/users/mozilla/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla/subscriptions","organizations_url":"https://api.github.com/users/mozilla/orgs","repos_url":"https://api.github.com/users/mozilla/repos","events_url":"https://api.github.com/users/mozilla/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla/received_events","type":"Organization","site_admin":false},"repo":{"id":4150376,"name":"trunion","full_name":"mozilla/trunion","owner":{"login":"mozilla","id":131524,"avatar_url":"https://avatars.githubusercontent.com/u/131524?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla","html_url":"https://github.com/mozilla","followers_url":"https://api.github.com/users/mozilla/followers","following_url":"https://api.github.com/users/mozilla/following{/other_user}","gists_url":"https://api.github.com/users/mozilla/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla/subscriptions","organizations_url":"https://api.github.com/users/mozilla/orgs","repos_url":"https://api.github.com/users/mozilla/repos","events_url":"https://api.github.com/users/mozilla/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla/trunion","description":"Receipt signing","fork":false,"url":"https://api.github.com/repos/mozilla/trunion","forks_url":"https://api.github.com/repos/mozilla/trunion/forks","keys_url":"https://api.github.com/repos/mozilla/trunion/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla/trunion/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla/trunion/teams","hooks_url":"https://api.github.com/repos/mozilla/trunion/hooks","issue_events_url":"https://api.github.com/repos/mozilla/trunion/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla/trunion/events","assignees_url":"https://api.github.com/repos/mozilla/trunion/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla/trunion/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla/trunion/tags","blobs_url":"https://api.github.com/repos/mozilla/trunion/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla/trunion/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla/trunion/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla/trunion/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla/trunion/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla/trunion/languages","stargazers_url":"https://api.github.com/repos/mozilla/trunion/stargazers","contributors_url":"https://api.github.com/repos/mozilla/trunion/contributors","subscribers_url":"https://api.github.com/repos/mozilla/trunion/subscribers","subscription_url":"https://api.github.com/repos/mozilla/trunion/subscription","commits_url":"https://api.github.com/repos/mozilla/trunion/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla/trunion/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla/trunion/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla/trunion/issues/comments/{number}","contents_url":"https://api.github.com/repos/mozilla/trunion/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla/trunion/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla/trunion/merges","archive_url":"https://api.github.com/repos/mozilla/trunion/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla/trunion/downloads","issues_url":"https://api.github.com/repos/mozilla/trunion/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla/trunion/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla/trunion/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla/trunion/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla/trunion/labels{/name}","releases_url":"https://api.github.com/repos/mozilla/trunion/releases{/id}","created_at":"2012-04-26T17:48:47Z","updated_at":"2014-07-24T21:13:54Z","pushed_at":"2015-02-05T17:01:37Z","git_url":"git://github.com/mozilla/trunion.git","ssh_url":"git@github.com:mozilla/trunion.git","clone_url":"https://github.com/mozilla/trunion.git","svn_url":"https://github.com/mozilla/trunion","homepage":"https://wiki.mozilla.org/Apps/WebApplicationReceipt/SigningService","size":312,"stargazers_count":1,"watchers_count":1,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mozilla/trunion/pulls/12"},"html":{"href":"https://github.com/mozilla/trunion/pull/12"},"issue":{"href":"https://api.github.com/repos/mozilla/trunion/issues/12"},"comments":{"href":"https://api.github.com/repos/mozilla/trunion/issues/12/comments"},"review_comments":{"href":"https://api.github.com/repos/mozilla/trunion/pulls/12/comments"},"review_comment":{"href":"https://api.github.com/repos/mozilla/trunion/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/mozilla/trunion/pulls/12/commits"},"statuses":{"href":"https://api.github.com/repos/mozilla/trunion/statuses/c1167b2c4aab951828ee02bd73f04da38545a054"}}}}