Opened 59 minutes ago
Last modified 57 minutes ago
#37492 new Bug
GeometryField.to_python() crashes with GDALException on invalid GeoJSON when the widget has no deserialize()
| Reported by: | Philip Sørensen | Owned by: | |
|---|---|---|---|
| Component: | GIS | Version: | dev |
| Severity: | Normal | Keywords: | |
| Cc: | Philip Sørensen | Triage Stage: | Unreviewed |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
#29978 made GeometryField.to_python() catch GDALException from widget.deserialize(). However, when the widget has no deserialize() method (e.g. widget=forms.TextInput, which test_field_with_text_widget covers), to_python() calls GEOSGeometry() directly and only catches GEOSException, ValueError and TypeError. For GeoJSON input that GDAL rejects, GEOSGeometry() raises GDALException, so clean() crashes (HTTP 500) instead of raising a ValidationError:
`python
from django import forms as django_forms
from django.contrib.gis import forms
forms.GeometryField(widget=django_forms.TextInput).clean("{}")
# GDALException: Invalid geometry pointer returned from "OGR_G_CreateGeometryFromJson".
`
'{"type": "Foo"}', '{"type": "Point"}' and '{"type": "Point", "coordinates": "x"}' crash the same way. This reproduces on 6.1.2, 6.1.3 and main. The default widget isn't affected, because BaseGeometryWidget.deserialize() catches GDALException.
Patch: add GDALException to the exceptions caught in the fallback.