Validate the request body on a finding metadata PUT

dojo/finding/api/views.py

@@ -749,17 +749,23 @@ def _edit_metadata(self, request, finding):
                 "Metadata name is required", status=status.HTTP_400_BAD_REQUEST,
             )
 
+        metadata_data = FindingMetaSerializer(data=request.data)
+        if not metadata_data.is_valid():
+            return Response(
+                metadata_data.errors, status=status.HTTP_400_BAD_REQUEST,
+            )
+
         try:
             DojoMeta.objects.update_or_create(
                 name=metadata_name,
                 finding=finding,
                 defaults={
-                    "name": request.data.get("name"),
-                    "value": request.data.get("value"),
+                    "name": metadata_data.validated_data["name"],
+                    "value": metadata_data.validated_data["value"],
                 },
             )
 
-            return Response(data=request.data, status=status.HTTP_200_OK)
+            return Response(data=metadata_data.data, status=status.HTTP_200_OK)
         except IntegrityError:
             return Response(
                 "Update failed because the new name already exists",

unittests/test_rest_framework.py

@@ -2490,6 +2490,26 @@ def test_update(self):
         self.assertEqual(result["name"], "test_meta", "Metadata not edited correctly")
         self.assertEqual(result["value"], "40", "Metadata not edited correctly")
 
+    def test_update_rejects_oversized_value(self):
+        response = self.client.put(
+            self.base_url + "?name=test_meta",
+            data={"name": "test_meta", "value": "x" * 301},
+        )
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code, response.data)
+
+        result = self.client.get(self.base_url).data[0]
+        self.assertEqual(result["value"], "20", "Rejected update still wrote to the database")
+
+    def test_update_rejects_missing_name(self):
+        response = self.client.put(self.base_url + "?name=test_meta", data={"value": "40"})
+        self.assertEqual(status.HTTP_400_BAD_REQUEST, response.status_code, response.data)
+        # The unvalidated path also 400s here, but via IntegrityError with a misleading message.
+        self.assertIsInstance(response.data, dict, response.data)
+        self.assertIn("name", response.data)
+
+        result = self.client.get(self.base_url).data[0]
+        self.assertEqual(result["value"], "20", "Rejected update still wrote to the database")
+
     def test_delete(self):
         self.client.delete(self.base_url + "?name=test_meta")
         result = self.client.get(self.base_url).data