Handle exceptions from json.loads in reauthenticate (#20361)

Author: di

tests/unit/accounts/test_views.py

@@ -3878,6 +3878,43 @@ def test_reauth_rejects_different_users_password(
         assert pyramid_request.session.record_auth_timestamp.calls == []
         assert pyramid_request.session.record_password_timestamp.calls == []
 
+    @pytest.mark.parametrize(
+        ("next_route_matchdict", "next_route_query"),
+        [
+            ("invalid_json", "{}"),
+            ("{}", "invalid_json"),
+            ("{'single': 'quotes'}", "{}"),
+            ("123", "{}"),
+            ("{}", "123"),
+            ("[1, 2]", "{}"),
+            ("{}", "[1, 2]"),
+            ("true", "{}"),
+            ("{}", '"string"'),
+        ],
+    )
+    def test_reauth_invalid_json_raises_400(
+        self, pyramid_request, pyramid_services, next_route_matchdict, next_route_query
+    ):
+        user_service = pretend.stub()
+        pyramid_services.register_service(user_service, IUserService, None)
+
+        pyramid_request.user = pretend.stub(id=pretend.stub(), username=pretend.stub())
+        pyramid_request.matched_route = pretend.stub(name=pretend.stub())
+        pyramid_request.matchdict = {}
+        pyramid_request.GET = pretend.stub(mixed=lambda: {})
+        pyramid_request.route_path = pretend.call_recorder(lambda *a, **kw: "/target")
+
+        form_obj = pretend.stub(
+            next_route=pretend.stub(data="/manage/accounts"),
+            next_route_matchdict=pretend.stub(data=next_route_matchdict),
+            next_route_query=pretend.stub(data=next_route_query),
+            validate=lambda: True,
+        )
+        form_class = pretend.call_recorder(lambda d, **kw: form_obj)
+
+        with pytest.raises(HTTPBadRequest):
+            views.reauthenticate(pyramid_request, _form_class=form_class)
+
 
 class TestManageAccountPublishingViews:
     def test_initializes(self, metrics):

warehouse/accounts/views.py

@@ -1666,11 +1666,17 @@ def reauthenticate(request, _form_class=ReAuthenticateForm):
     )
 
     if form.next_route.data and form.next_route_matchdict.data:
-        redirect_to = request.route_path(
-            form.next_route.data,
-            **json.loads(form.next_route_matchdict.data)
-            | {"_query": json.loads(form.next_route_query.data)},
-        )
+        try:
+            matchdict = json.loads(form.next_route_matchdict.data)
+            query = json.loads(form.next_route_query.data)
+            if not isinstance(matchdict, dict) or not isinstance(query, dict):
+                raise HTTPBadRequest
+            redirect_to = request.route_path(
+                form.next_route.data,
+                **matchdict | {"_query": query},
+            )
+        except json.JSONDecodeError, KeyError, TypeError, ValueError:
+            raise HTTPBadRequest
     else:
         redirect_to = request.route_path("manage.projects")