From df851c117db031dec50dd4ef1ca34745920ac77a Mon Sep 17 00:00:00 2001
From: Simon Willison <swillison@gmail.com>
Date: Mon, 19 Sep 2022 16:46:39 -0700
Subject: [PATCH] Validate settings.json keys on startup, closes #1816

Refs #1814
---
 datasette/app.py         |  4 ++++
 tests/test_config_dir.py | 20 ++++++++++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/datasette/app.py b/datasette/app.py
index ea3e7b43..8873ce28 100644
--- a/datasette/app.py
+++ b/datasette/app.py
@@ -292,6 +292,10 @@ class Datasette:
             raise StartupError("config.json should be renamed to settings.json")
         if config_dir and (config_dir / "settings.json").exists() and not settings:
             settings = json.loads((config_dir / "settings.json").read_text())
+            # Validate those settings
+            for key in settings:
+                if key not in DEFAULT_SETTINGS:
+                    raise StartupError("Invalid setting '{key}' in settings.json")
         self._settings = dict(DEFAULT_SETTINGS, **(settings or {}))
         self.renderers = {}  # File extension -> (renderer, can_render) functions
         self.version_note = version_note
diff --git a/tests/test_config_dir.py b/tests/test_config_dir.py
index fe927c42..e365515b 100644
--- a/tests/test_config_dir.py
+++ b/tests/test_config_dir.py
@@ -5,6 +5,7 @@ import pytest
 from datasette.app import Datasette
 from datasette.cli import cli
 from datasette.utils.sqlite import sqlite3
+from datasette.utils import StartupError
 from .fixtures import TestClient as _TestClient
 from click.testing import CliRunner
 
@@ -27,9 +28,8 @@ body { margin-top: 3em}
 
 
 @pytest.fixture(scope="session")
-def config_dir_client(tmp_path_factory):
+def config_dir(tmp_path_factory):
     config_dir = tmp_path_factory.mktemp("config-dir")
-
     plugins_dir = config_dir / "plugins"
     plugins_dir.mkdir()
     (plugins_dir / "hooray.py").write_text(PLUGIN, "utf-8")
@@ -77,7 +77,23 @@ def config_dir_client(tmp_path_factory):
         ),
         "utf-8",
     )
+    return config_dir
 
+
+def test_invalid_settings(config_dir):
+    previous = (config_dir / "settings.json").read_text("utf-8")
+    (config_dir / "settings.json").write_text(
+        json.dumps({"invalid": "invalid-setting"}), "utf-8"
+    )
+    try:
+        with pytest.raises(StartupError):
+            ds = Datasette([], config_dir=config_dir)
+    finally:
+        (config_dir / "settings.json").write_text(previous, "utf-8")
+
+
+@pytest.fixture(scope="session")
+def config_dir_client(config_dir):
     ds = Datasette([], config_dir=config_dir)
     yield _TestClient(ds)