[pve-devel] [PATCH widget-toolkit v4] window: edit: avoid sharing custom config objects between subclasses

[pve-devel] [PATCH widget-toolkit v4] window: edit: avoid sharing custom config objects between subclasses

[Friedrich Weber]

Currently, `Proxmox.window.Edit` initializes `extraRequestParams` and
`submitOptions` to two objects that, if not overwritten, are shared
between all instances of subclasses. This bears the danger of
modifying the shared object in a subclass instead of overwriting it,
which affects all edit windows of the current session and can cause
hard-to-catch GUI bugs.

One such bug is the following: Currently, the `PVE.pool.AddStorage`
component inadvertently adds `poolid` to an `extraRequestParams`
object that is shared between all instances of `Proxmox.window.Edit`.
As a result, after adding a storage to a pool, opening any edit window
will send a GET request with a superfluous `poolid` parameter and
cause an error in the GUI:

> Parameter verification failed. (400)
> poolid: property is not defined in schema and the schema does not
> allow additional properties

This breaks all edit windows of the current session. A workaround is
to reload the current browser session.

To avoid this class of bugs in the future, implement a constructor
that makes copies of `extraRequestParams` and `submitOptions`. This
ensures that any subclass instance modifies only its own copies, and
modifications do not leak to other subclass instances.

Suggested-by: Stefan Sterz <s.sterz@proxmox.com>
Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Friedrich Weber <f.weber@proxmox.com>
---

Notes:
    @Thomas, I've added a Suggested-by, feel free to remove/keep as you
    prefer.
    
    Changes from v3:
    - Fix broken pool edit window (thx sterzy!) by passing all arguments
      to `callParent`. The `initConfig` call is obsolete as the constructor
      of `Ext.Component` [1] calls `initConfig` already.
    
    Changes from v1+v2:
    - As suggested by sterzy (thx!), avoid this class of bugs in a more
      generic fashion by introducing a `Proxmox.window.Edit` constructor
      that copies custom config objects
    - Added full error message to commit message for better searchability
    
    v3: https://lists.proxmox.com/pipermail/pve-devel/2024-April/062657.html
    v2: https://lists.proxmox.com/pipermail/pve-devel/2024-April/062561.html
    v1: https://lists.proxmox.com/pipermail/pve-devel/2024-March/062179.html
    
    [1] https://docs.sencha.com/extjs/7.0.0/classic/src/Component.js.html#line2203

 src/window/Edit.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/window/Edit.js b/src/window/Edit.js
index d4a2b551..c55ff793 100644
--- a/src/window/Edit.js
+++ b/src/window/Edit.js
@@ -69,6 +69,15 @@ Ext.define('Proxmox.window.Edit', {
     // onlineHelp of our first item, if set.
     onlineHelp: undefined,
 
+    constructor: function(conf) {
+	let me = this;
+	// make copies in order to prevent subclasses from accidentally writing
+	// to objects that are shared with other edit window subclasses
+	me.extraRequestParams = Object.assign({}, me.extraRequestParams);
+	me.submitOptions = Object.assign({}, me.submitOptions);
+	me.callParent(arguments);
+    },
+
     isValid: function() {
 	let me = this;
 
-- 
2.39.2

Re: [pve-devel] [PATCH widget-toolkit v4] window: edit: avoid sharing custom config objects between subclasses

[Stefan Sterz]

On Tue Apr 9, 2024 at 10:16 AM CEST, Friedrich Weber wrote:
> Currently, `Proxmox.window.Edit` initializes `extraRequestParams` and
> `submitOptions` to two objects that, if not overwritten, are shared
> between all instances of subclasses. This bears the danger of
> modifying the shared object in a subclass instead of overwriting it,
> which affects all edit windows of the current session and can cause
> hard-to-catch GUI bugs.
>
> One such bug is the following: Currently, the `PVE.pool.AddStorage`
> component inadvertently adds `poolid` to an `extraRequestParams`
> object that is shared between all instances of `Proxmox.window.Edit`.
> As a result, after adding a storage to a pool, opening any edit window
> will send a GET request with a superfluous `poolid` parameter and
> cause an error in the GUI:
>
> > Parameter verification failed. (400)
> > poolid: property is not defined in schema and the schema does not
> > allow additional properties
>
> This breaks all edit windows of the current session. A workaround is
> to reload the current browser session.
>
> To avoid this class of bugs in the future, implement a constructor
> that makes copies of `extraRequestParams` and `submitOptions`. This
> ensures that any subclass instance modifies only its own copies, and
> modifications do not leak to other subclass instances.
>
> Suggested-by: Stefan Sterz <s.sterz@proxmox.com>
> Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
> Signed-off-by: Friedrich Weber <f.weber@proxmox.com>
> ---
>
> Notes:
>     @Thomas, I've added a Suggested-by, feel free to remove/keep as you
>     prefer.
>
>     Changes from v3:
>     - Fix broken pool edit window (thx sterzy!) by passing all arguments
>       to `callParent`. The `initConfig` call is obsolete as the constructor
>       of `Ext.Component` [1] calls `initConfig` already.
>
>     Changes from v1+v2:
>     - As suggested by sterzy (thx!), avoid this class of bugs in a more
>       generic fashion by introducing a `Proxmox.window.Edit` constructor
>       that copies custom config objects
>     - Added full error message to commit message for better searchability
>
>     v3: https://lists.proxmox.com/pipermail/pve-devel/2024-April/062657.html
>     v2: https://lists.proxmox.com/pipermail/pve-devel/2024-April/062561.html
>     v1: https://lists.proxmox.com/pipermail/pve-devel/2024-March/062179.html
>
>     [1] https://docs.sencha.com/extjs/7.0.0/classic/src/Component.js.html#line2203
>
>  src/window/Edit.js | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/src/window/Edit.js b/src/window/Edit.js
> index d4a2b551..c55ff793 100644
> --- a/src/window/Edit.js
> +++ b/src/window/Edit.js
> @@ -69,6 +69,15 @@ Ext.define('Proxmox.window.Edit', {
>      // onlineHelp of our first item, if set.
>      onlineHelp: undefined,
>
> +    constructor: function(conf) {
> +	let me = this;
> +	// make copies in order to prevent subclasses from accidentally writing
> +	// to objects that are shared with other edit window subclasses
> +	me.extraRequestParams = Object.assign({}, me.extraRequestParams);
> +	me.submitOptions = Object.assign({}, me.submitOptions);
> +	me.callParent(arguments);
> +    },
> +
>      isValid: function() {
>  	let me = this;
>

this looks good to me, i've also tested this here, so consider this:

Tested-by: Stefan Sterz <s.sterz@proxmox>

[pve-devel] applied: [PATCH widget-toolkit v4] window: edit: avoid sharing custom config objects between subclasses

[Thomas Lamprecht]

Am 09/04/2024 um 10:16 schrieb Friedrich Weber:
> Currently, `Proxmox.window.Edit` initializes `extraRequestParams` and
> `submitOptions` to two objects that, if not overwritten, are shared
> between all instances of subclasses. This bears the danger of
> modifying the shared object in a subclass instead of overwriting it,
> which affects all edit windows of the current session and can cause
> hard-to-catch GUI bugs.
> 
> One such bug is the following: Currently, the `PVE.pool.AddStorage`
> component inadvertently adds `poolid` to an `extraRequestParams`
> object that is shared between all instances of `Proxmox.window.Edit`.
> As a result, after adding a storage to a pool, opening any edit window
> will send a GET request with a superfluous `poolid` parameter and
> cause an error in the GUI:
> 
>> Parameter verification failed. (400)
>> poolid: property is not defined in schema and the schema does not
>> allow additional properties
> 
> This breaks all edit windows of the current session. A workaround is
> to reload the current browser session.
> 
> To avoid this class of bugs in the future, implement a constructor
> that makes copies of `extraRequestParams` and `submitOptions`. This
> ensures that any subclass instance modifies only its own copies, and
> modifications do not leak to other subclass instances.
> 
> Suggested-by: Stefan Sterz <s.sterz@proxmox.com>
> Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
> Signed-off-by: Friedrich Weber <f.weber@proxmox.com>
> ---
> 
> Notes:
>     @Thomas, I've added a Suggested-by, feel free to remove/keep as you
>     prefer.
>     
>     Changes from v3:
>     - Fix broken pool edit window (thx sterzy!) by passing all arguments
>       to `callParent`. The `initConfig` call is obsolete as the constructor
>       of `Ext.Component` [1] calls `initConfig` already.
>     
>     Changes from v1+v2:
>     - As suggested by sterzy (thx!), avoid this class of bugs in a more
>       generic fashion by introducing a `Proxmox.window.Edit` constructor
>       that copies custom config objects
>     - Added full error message to commit message for better searchability
>     
>     v3: https://lists.proxmox.com/pipermail/pve-devel/2024-April/062657.html
>     v2: https://lists.proxmox.com/pipermail/pve-devel/2024-April/062561.html
>     v1: https://lists.proxmox.com/pipermail/pve-devel/2024-March/062179.html
>     
>     [1] https://docs.sencha.com/extjs/7.0.0/classic/src/Component.js.html#line2203
> 
>  src/window/Edit.js | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
>

applied, with Stefan's T-b, thanks!