From f7f90399b992ffaa8f9110654cb8840db4e2e2eb Mon Sep 17 00:00:00 2001 From: Dan LaManna Date: Thu, 29 Oct 2026 08:47:31 -0400 Subject: [PATCH] Handle non-integer task ids on the leaderboard page The task query parameter was passed straight to a primary key lookup, so any non-numeric value raised an unhandled ValueError. Vulnerability scanners hit this constantly. Treat a non-integer value the same as a missing one and fall back to the first task. --- stade/core/tests/test_leaderboard.py | 9 +++++++++ stade/core/views.py | 5 ++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/stade/core/tests/test_leaderboard.py b/stade/core/tests/test_leaderboard.py index 036e883..c9af8d0 100644 --- a/stade/core/tests/test_leaderboard.py +++ b/stade/core/tests/test_leaderboard.py @@ -118,3 +118,12 @@ def test_leaderboard_by_team(task_with_submissions, client): assert third['approach__team__name'] == 'team_8' assert third['approach__name'] == 'approach_1' assert third['overall_score'] == 0.60 + + +@pytest.mark.django_db +def test_leaderboard_invalid_task_falls_back_to_first_task(task_with_submissions, client): + resp = client.get( + f'/leaderboards/{task_with_submissions.challenge.slug}/?task=%27nvOpzp;%20AND%201=1' + ) + assert resp.status_code == 200 + assert resp.context['active_task'] == task_with_submissions diff --git a/stade/core/views.py b/stade/core/views.py index d9528eb..72492f4 100644 --- a/stade/core/views.py +++ b/stade/core/views.py @@ -37,7 +37,10 @@ def handler500(request): def leaderboard_page(request, challenge): - task_id = request.GET.get('task') + try: + task_id = int(request.GET.get('task', '')) + except ValueError: + task_id = None group_by = request.GET.get('group_by') if group_by not in ['team', 'approach']: