Opened 59 minutes ago

Last modified 57 minutes ago

#37492 new Bug

GeometryField.to_python() crashes with GDALException on invalid GeoJSON when the widget has no deserialize()

Reported by: Philip Sørensen Owned by:
Component: GIS Version: dev
Severity: Normal Keywords:
Cc: Philip Sørensen Triage Stage: Unreviewed
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

#29978 made GeometryField.to_python() catch GDALException from widget.deserialize(). However, when the widget has no deserialize() method (e.g. widget=forms.TextInput, which test_field_with_text_widget covers), to_python() calls GEOSGeometry() directly and only catches GEOSException, ValueError and TypeError. For GeoJSON input that GDAL rejects, GEOSGeometry() raises GDALException, so clean() crashes (HTTP 500) instead of raising a ValidationError:

`python
from django import forms as django_forms
from django.contrib.gis import forms
forms.GeometryField(widget=django_forms.TextInput).clean("{}")
# GDALException: Invalid geometry pointer returned from "OGR_G_CreateGeometryFromJson".
`

'{"type": "Foo"}', '{"type": "Point"}' and '{"type": "Point", "coordinates": "x"}' crash the same way. This reproduces on 6.1.2, 6.1.3 and main. The default widget isn't affected, because BaseGeometryWidget.deserialize() catches GDALException.

Patch: add GDALException to the exceptions caught in the fallback.

Change History (1)

comment:1 by Philip Sørensen, 57 minutes ago

Has patch: set
Note: See TracTickets for help on using tickets.
Back to Top