Skip to content

Commit aa05a15

Browse files
RusJaIRusJaI
committed
Validate quota limits to be non-negative in throttling policies
1 parent dcfc952 commit aa05a15

File tree

3 files changed

+95
-6
lines changed

3 files changed

+95
-6
lines changed

Diff for: ‎components/apimgt/org.wso2.carbon.apimgt.api/src/main/java/org/wso2/carbon/apimgt/api/ExceptionCodes.java

+1
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,7 @@ public enum ExceptionCodes implements ErrorHandler {
426426
EXTERNAL_STORE_ID_NOT_FOUND(901200,"External Store Not Found", 404, "Error while publishing to external stores. " +
427427
"External Store Not Found"),
428428

429+
INVALID_QUOTA_LIMIT(901201, "Invalid Quota Limit", 400, "Quota limit should be non negative. "),
429430

430431
// Tenant related
431432
INVALID_TENANT(901300,"Tenant Not Found", 400, "Tenant Not Found"),

Diff for: ‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/main/java/org/wso2/carbon/apimgt/rest/api/admin/v1/impl/ThrottlingApiServiceImpl.java

+3
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ public Response throttlingPoliciesAdvancedPost(String contentType, AdvancedThrot
111111
MessageContext messageContext) throws APIManagementException {
112112

113113
RestApiAdminUtils.validateThrottlePolicyNameProperty(body.getPolicyName());
114+
RestApiAdminUtils.validateThrottlePolicyDefaultLimitProperty(body);
114115

115116
try {
116117
APIProvider apiProvider = RestApiCommonUtil.getLoggedInUserProvider();
@@ -304,6 +305,7 @@ public Response throttlingPoliciesApplicationPost(String contentType, Applicatio
304305
MessageContext messageContext) throws APIManagementException {
305306

306307
RestApiAdminUtils.validateThrottlePolicyNameProperty(body.getPolicyName());
308+
RestApiAdminUtils.validateThrottlePolicyDefaultLimitProperty(body);
307309

308310
try {
309311
APIProvider apiProvider = RestApiCommonUtil.getLoggedInUserProvider();
@@ -504,6 +506,7 @@ public Response throttlingPoliciesSubscriptionPost(String contentType, Subscript
504506
MessageContext messageContext) throws APIManagementException {
505507

506508
RestApiAdminUtils.validateThrottlePolicyNameProperty(body.getPolicyName());
509+
RestApiAdminUtils.validateThrottlePolicyDefaultLimitProperty(body);
507510

508511
try {
509512
APIProvider apiProvider = RestApiCommonUtil.getLoggedInUserProvider();

Diff for: ‎components/apimgt/org.wso2.carbon.apimgt.rest.api.admin.v1/src/main/java/org/wso2/carbon/apimgt/rest/api/admin/v1/utils/RestApiAdminUtils.java

+91-6
Original file line numberDiff line numberDiff line change
@@ -25,28 +25,27 @@
2525
import org.wso2.carbon.apimgt.api.APIManagementException;
2626
import org.wso2.carbon.apimgt.api.ExceptionCodes;
2727
import org.wso2.carbon.apimgt.api.model.BlockConditionsDTO;
28-
import org.wso2.carbon.apimgt.api.model.policy.AIAPIQuotaLimit;
2928
import org.wso2.carbon.apimgt.api.model.policy.Policy;
30-
import org.wso2.carbon.apimgt.api.model.policy.QuotaPolicy;
3129
import org.wso2.carbon.apimgt.impl.APIAdminImpl;
3230
import org.wso2.carbon.apimgt.impl.APIConstants;
3331
import org.wso2.carbon.apimgt.impl.utils.APIUtil;
34-
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.AIAPIQuotaLimitDTO;
3532
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.CustomRuleDTO;
3633
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ThrottleConditionDTO;
3734
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ThrottleLimitDTO;
35+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ThrottlePolicyDTO;
36+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.AdvancedThrottlePolicyDTO;
37+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.ApplicationThrottlePolicyDTO;
38+
import org.wso2.carbon.apimgt.rest.api.admin.v1.dto.SubscriptionThrottlePolicyDTO;
3839
import org.wso2.carbon.apimgt.rest.api.common.RestApiConstants;
3940
import org.wso2.carbon.utils.multitenancy.MultitenantUtils;
4041

4142
import java.io.File;
4243
import java.io.FileOutputStream;
4344
import java.io.IOException;
4445
import java.io.InputStream;
45-
import java.util.Arrays;
46-
import java.util.HashSet;
46+
import java.util.*;
4747
import java.util.regex.Matcher;
4848
import java.util.regex.Pattern;
49-
import java.util.Set;
5049
import java.util.zip.ZipEntry;
5150
import java.util.zip.ZipInputStream;
5251

@@ -142,6 +141,92 @@ public static void validateThrottlePolicyNameProperty(String policyName)
142141
}
143142
}
144143

144+
public static void validateThrottlePolicyDefaultLimitProperty(ThrottlePolicyDTO throttlePolicyDTO)
145+
throws APIManagementException {
146+
ThrottleLimitDTO throttleLimitDTO;
147+
if (throttlePolicyDTO instanceof AdvancedThrottlePolicyDTO) {
148+
throttleLimitDTO = ((AdvancedThrottlePolicyDTO) throttlePolicyDTO).getDefaultLimit();
149+
validateRequestCountLimit(throttleLimitDTO);
150+
validateBandwidthLimit(throttleLimitDTO);
151+
} else if (throttlePolicyDTO instanceof ApplicationThrottlePolicyDTO) {
152+
throttleLimitDTO = ((ApplicationThrottlePolicyDTO) throttlePolicyDTO).getDefaultLimit();
153+
validateRequestCountLimit(throttleLimitDTO);
154+
validateBandwidthLimit(throttleLimitDTO);
155+
if (((ApplicationThrottlePolicyDTO) throttlePolicyDTO).getBurstLimit() != null) {
156+
if (((ApplicationThrottlePolicyDTO) throttlePolicyDTO).getBurstLimit().getRateLimitCount() < 0) {
157+
throw new APIManagementException("Burst Control rate limit should be a non-negative value",
158+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
159+
String.valueOf(throttleLimitDTO.getRequestCount().getRequestCount())));
160+
}
161+
}
162+
} else if (throttlePolicyDTO instanceof SubscriptionThrottlePolicyDTO) {
163+
throttleLimitDTO = ((SubscriptionThrottlePolicyDTO) throttlePolicyDTO).getDefaultLimit();
164+
validateRequestCountLimit(throttleLimitDTO);
165+
validateBandwidthLimit(throttleLimitDTO);
166+
validateEventCountLimit(throttleLimitDTO);
167+
validateAiQuotaLimit(throttleLimitDTO);
168+
if (((SubscriptionThrottlePolicyDTO) throttlePolicyDTO).getRateLimitCount() < 0) {
169+
throw new APIManagementException("Rate limit count should be a non-negative value",
170+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
171+
String.valueOf(throttleLimitDTO.getRequestCount().getRequestCount())));
172+
}
173+
}
174+
}
175+
176+
private static void validateRequestCountLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
177+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.REQUESTCOUNTLIMIT)) {
178+
if (throttleLimitDTO.getRequestCount().getRequestCount() < 0) {
179+
throw new APIManagementException("Request count should be a non-negative value",
180+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
181+
String.valueOf(throttleLimitDTO.getRequestCount().getRequestCount())));
182+
}
183+
}
184+
}
185+
186+
private static void validateBandwidthLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
187+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.BANDWIDTHLIMIT)) {
188+
if (throttleLimitDTO.getBandwidth().getDataAmount() < 0) {
189+
throw new APIManagementException("Bandwidth should be a non-negative value",
190+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
191+
String.valueOf(throttleLimitDTO.getBandwidth().getDataAmount())));
192+
}
193+
}
194+
}
195+
196+
private static void validateEventCountLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
197+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.EVENTCOUNTLIMIT)) {
198+
if (throttleLimitDTO.getEventCount().getEventCount() < 0) {
199+
throw new APIManagementException("Event count should be a non-negative value",
200+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
201+
String.valueOf(throttleLimitDTO.getEventCount().getEventCount())));
202+
}
203+
}
204+
}
205+
206+
private static void validateAiQuotaLimit(ThrottleLimitDTO throttleLimitDTO) throws APIManagementException {
207+
if (throttleLimitDTO.getType().equals(ThrottleLimitDTO.TypeEnum.AIAPIQUOTALIMIT)) {
208+
List<String> paramNames = new ArrayList<>();
209+
if (throttleLimitDTO.getAiApiQuota().getRequestCount() < 0) {
210+
paramNames.add("Request Count");
211+
}
212+
if (throttleLimitDTO.getAiApiQuota().getTotalTokenCount() < 0) {
213+
paramNames.add("Total Token Count");
214+
}
215+
if (throttleLimitDTO.getAiApiQuota().getPromptTokenCount() < 0) {
216+
paramNames.add("Prompt Token Count");
217+
}
218+
if (throttleLimitDTO.getAiApiQuota().getCompletionTokenCount() < 0) {
219+
paramNames.add("Complete Token Count");
220+
}
221+
222+
if (!paramNames.isEmpty()) {
223+
throw new APIManagementException("AI quota limit should be a non-negative value",
224+
ExceptionCodes.from(ExceptionCodes.INVALID_QUOTA_LIMIT,
225+
String.join(",", paramNames)));
226+
}
227+
}
228+
}
229+
145230
public static void validateIPAddress(String ipAddress) throws APIManagementException {
146231
String ip4 = "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}" +
147232
"([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$";

0 commit comments

Comments
 (0)