Skip to content

Commit 14235a3

Browse files
RusJaIRusJaI
committed
Validate quota limits to be non-negative in throttling policies
1 parent dcfc952 commit 14235a3

File tree

3 files changed

+97
-4
lines changed

3 files changed

+97
-4
lines changed

Diff for: ‎components/apimgt/org.wso2.carbon.apimgt.api/src/main/java/org/wso2/carbon/apimgt/api/ExceptionCodes.java

+1
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,7 @@ public enum ExceptionCodes implements ErrorHandler {
426426
EXTERNAL_STORE_ID_NOT_FOUND(901200,"External Store Not Found", 404, "Error while publishing to external stores. " +
427427
"External Store Not Found"),
428428

429+
INVALID_QUOTA_LIMIT(901201, "Invalid Quota Limit", 400, "Quota limit should be non negative. "),
429430

430431
// Tenant related
431432
INVALID_TENANT(901300,"Tenant Not Found", 400, "Tenant Not Found"),

Diff for: ‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/main/java/org/wso2/carbon/apimgt/rest/api/admin/v1/impl/ThrottlingApiServiceImpl.java

+3
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ public Response throttlingPoliciesAdvancedPost(String contentType, AdvancedThrot
111111
MessageContext messageContext) throws APIManagementException {
112112

113113
RestApiAdminUtils.validateThrottlePolicyNameProperty(body.getPolicyName());
114+
RestApiAdminUtils.validateThrottlePolicyDefaultLimitProperty(body);
114115

115116
try {
116117
APIProvider apiProvider = RestApiCommonUtil.getLoggedInUserProvider();
@@ -304,6 +305,7 @@ public Response throttlingPoliciesApplicationPost(String contentType, Applicatio
304305
MessageContext messageContext) throws APIManagementException {
305306

306307
RestApiAdminUtils.validateThrottlePolicyNameProperty(body.getPolicyName());
308+
RestApiAdminUtils.validateThrottlePolicyDefaultLimitProperty(body);
307309

308310
try {
309311
APIProvider apiProvider = RestApiCommonUtil.getLoggedInUserProvider();
@@ -504,6 +506,7 @@ public Response throttlingPoliciesSubscriptionPost(String contentType, Subscript
504506
MessageContext messageContext) throws APIManagementException {
505507

506508
RestApiAdminUtils.validateThrottlePolicyNameProperty(body.getPolicyName());
509+
RestApiAdminUtils.validateThrottlePolicyDefaultLimitProperty(body);
507510

508511
try {
509512
APIProvider apiProvider = RestApiCommonUtil.getLoggedInUserProvider();

Diff for: ‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/main/java/org/wso2/carbon/apimgt/rest/api/admin/v1/utils/RestApiAdminUtils.java

+93-4
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,17 @@
2525
import org.wso2.carbon.apimgt.api.APIManagementException;
2626
import org.wso2.carbon.apimgt.api.ExceptionCodes;
2727
import org.wso2.carbon.apimgt.api.model.BlockConditionsDTO;
28-
import org.wso2.carbon.apimgt.api.model.policy.AIAPIQuotaLimit;
2928
import org.wso2.carbon.apimgt.api.model.policy.Policy;
30-
import org.wso2.carbon.apimgt.api.model.policy.QuotaPolicy;
3129
import org.wso2.carbon.apimgt.impl.APIAdminImpl;
3230
import org.wso2.carbon.apimgt.impl.APIConstants;
3331
import org.wso2.carbon.apimgt.impl.utils.APIUtil;
34-
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.AIAPIQuotaLimitDTO;
3532
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.CustomRuleDTO;
3633
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ThrottleConditionDTO;
3734
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ThrottleLimitDTO;
35+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ThrottlePolicyDTO;
36+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.AdvancedThrottlePolicyDTO;
37+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ApplicationThrottlePolicyDTO;
38+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.SubscriptionThrottlePolicyDTO;
3839
import org.wso2.carbon.apimgt.rest.api.common.RestApiConstants;
3940
import org.wso2.carbon.utils.multitenancy.MultitenantUtils;
4041

@@ -43,10 +44,12 @@
4344
import java.io.IOException;
4445
import java.io.InputStream;
4546
import java.util.Arrays;
47+
import java.util.ArrayList;
4648
import java.util.HashSet;
49+
import java.util.List;
50+
import java.util.Set;
4751
import java.util.regex.Matcher;
4852
import java.util.regex.Pattern;
49-
import java.util.Set;
5053
import java.util.zip.ZipEntry;
5154
import java.util.zip.ZipInputStream;
5255

@@ -142,6 +145,92 @@ public static void validateThrottlePolicyNameProperty(String policyName)
142145
}
143146
}
144147

148+
public static void validateThrottlePolicyDefaultLimitProperty(ThrottlePolicyDTO throttlePolicyDTO)
149+
throws APIManagementException {
150+
ThrottleLimitDTO throttleLimitDTO;
151+
if (throttlePolicyDTO instanceof AdvancedThrottlePolicyDTO) {
152+
throttleLimitDTO = ((AdvancedThrottlePolicyDTO) throttlePolicyDTO).getDefaultLimit();
153+
validateRequestCountLimit(throttleLimitDTO);
154+
validateBandwidthLimit(throttleLimitDTO);
155+
} else if (throttlePolicyDTO instanceof ApplicationThrottlePolicyDTO) {
156+
throttleLimitDTO = ((ApplicationThrottlePolicyDTO) throttlePolicyDTO).getDefaultLimit();
157+
validateRequestCountLimit(throttleLimitDTO);
158+
validateBandwidthLimit(throttleLimitDTO);
159+
if (((ApplicationThrottlePolicyDTO) throttlePolicyDTO).getBurstLimit() != null) {
160+
if (((ApplicationThrottlePolicyDTO) throttlePolicyDTO).getBurstLimit().getRateLimitCount() < 0) {
161+
throw new APIManagementException("Burst Control rate limit should be a non-negative value",
162+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
163+
String.valueOf(throttleLimitDTO.getRequestCount().getRequestCount())));
164+
}
165+
}
166+
} else if (throttlePolicyDTO instanceof SubscriptionThrottlePolicyDTO) {
167+
throttleLimitDTO = ((SubscriptionThrottlePolicyDTO) throttlePolicyDTO).getDefaultLimit();
168+
validateRequestCountLimit(throttleLimitDTO);
169+
validateBandwidthLimit(throttleLimitDTO);
170+
validateEventCountLimit(throttleLimitDTO);
171+
validateAiQuotaLimit(throttleLimitDTO);
172+
if (((SubscriptionThrottlePolicyDTO) throttlePolicyDTO).getRateLimitCount() < 0) {
173+
throw new APIManagementException("Rate limit count should be a non-negative value",
174+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
175+
String.valueOf(throttleLimitDTO.getRequestCount().getRequestCount())));
176+
}
177+
}
178+
}
179+
180+
private static void validateRequestCountLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
181+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.REQUESTCOUNTLIMIT)) {
182+
if (throttleLimitDTO.getRequestCount().getRequestCount() < 0) {
183+
throw new APIManagementException("Request count should be a non-negative value",
184+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
185+
String.valueOf(throttleLimitDTO.getRequestCount().getRequestCount())));
186+
}
187+
}
188+
}
189+
190+
private static void validateBandwidthLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
191+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.BANDWIDTHLIMIT)) {
192+
if (throttleLimitDTO.getBandwidth().getDataAmount() < 0) {
193+
throw new APIManagementException("Bandwidth should be a non-negative value",
194+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
195+
String.valueOf(throttleLimitDTO.getBandwidth().getDataAmount())));
196+
}
197+
}
198+
}
199+
200+
private static void validateEventCountLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
201+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.EVENTCOUNTLIMIT)) {
202+
if (throttleLimitDTO.getEventCount().getEventCount() < 0) {
203+
throw new APIManagementException("Event count should be a non-negative value",
204+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
205+
String.valueOf(throttleLimitDTO.getEventCount().getEventCount())));
206+
}
207+
}
208+
}
209+
210+
private static void validateAiQuotaLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
211+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.AIAPIQUOTALIMIT)) {
212+
List<String> paramNames = new ArrayList<>();
213+
if (throttleLimitDTO.getAiApiQuota().getRequestCount() < 0) {
214+
paramNames.add("Request Count");
215+
}
216+
if (throttleLimitDTO.getAiApiQuota().getTotalTokenCount() < 0) {
217+
paramNames.add("Total Token Count");
218+
}
219+
if (throttleLimitDTO.getAiApiQuota().getPromptTokenCount() < 0) {
220+
paramNames.add("Prompt Token Count");
221+
}
222+
if (throttleLimitDTO.getAiApiQuota().getCompletionTokenCount() < 0) {
223+
paramNames.add("Complete Token Count");
224+
}
225+
226+
if (!paramNames.isEmpty()) {
227+
throw new APIManagementException("AI quota limit should be a non-negative value",
228+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
229+
String.join(",", paramNames)));
230+
}
231+
}
232+
}
233+
145234
public static void validateIPAddress(String ipAddress) throws APIManagementException {
146235
String ip4 = "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}" +
147236
"([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$";

0 commit comments

Comments
 (0)