From 74f3a34eab01279837f4715de6ae864dcbaf9e5d Mon Sep 17 00:00:00 2001
From: Aurélien Bompard <aurelien@bompard.org>
Date: Aug 25 2017 10:02:50 +0000
Subject: Protect the badges widget against invalid and malformed data


---

diff --git a/hubs/tests/widgets/test_badges.py b/hubs/tests/widgets/test_badges.py
index d460a1f..a984070 100644
--- a/hubs/tests/widgets/test_badges.py
+++ b/hubs/tests/widgets/test_badges.py
@@ -2,6 +2,8 @@ from __future__ import unicode_literals
 
 import json
 
+from mock import Mock, patch
+
 import hubs.widgets
 from hubs.tests import FakeAuthorization, widget_instance
 from . import WidgetTest
@@ -63,3 +65,23 @@ class TestBadges(WidgetTest):
 
     def test_view_authz(self):
         self._test_view_authz()
+
+    @patch("hubs.widgets.badges.requests")
+    def test_invalid_data(self, requests):
+        response = Mock()
+        response.json.side_effect = ValueError("invalid value")
+        requests.get.return_value = response
+        widget = widget_instance('ralph', self.plugin)
+        func = widget.module.get_cached_functions()['GetBadges']
+        result = func(widget).execute()
+        self.assertEqual(result, dict(assertions=[]))
+
+    @patch("hubs.widgets.badges.requests")
+    def test_malformed_data(self, requests):
+        response = Mock()
+        response.json.return_value = {}
+        requests.get.return_value = response
+        widget = widget_instance('ralph', self.plugin)
+        func = widget.module.get_cached_functions()['GetBadges']
+        result = func(widget).execute()
+        self.assertEqual(result, dict(assertions=[]))
diff --git a/hubs/widgets/badges/__init__.py b/hubs/widgets/badges/__init__.py
index 1e5fcea..f3e8f78 100644
--- a/hubs/widgets/badges/__init__.py
+++ b/hubs/widgets/badges/__init__.py
@@ -38,7 +38,10 @@ class GetBadges(CachedFunction):
         url = "https://badges.fedoraproject.org/user/{username}/json"
         url = url.format(username=username)
         response = requests.get(url)
-        assertions = response.json()['assertions']
+        try:
+            assertions = response.json()['assertions']
+        except (KeyError, ValueError):
+            assertions = []
         key = operator.itemgetter('issued')
         return dict(assertions=sorted(assertions, key=key, reverse=True))