From 460756fc9b0edd981d3a853b58e85088b9d5110e Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Fri, 14 Oct 2016 08:57:30 +0000 Subject: [PATCH] [SIGNED-OFF] BUG 17445: Add 'malformed query' error response This patch adds to the x-mojo-around action code to give a meaningful error given a bad query parameter in the query string for a request. Test Plan 1) Submit an api request to an existing restful endpoint with no query parameters 2) Confirm the correct response is being given 3) Submit an api request to an existing restful endpoint with an allowed query parameter 4) Confimr the correct response is being given 5) Submit an api request to an existing restful endpoint with a malformed query paramter 6) Note the 400 response code and helpful json api body https://bugs.koha-community.org/show_bug.cgi?id=17445 Signed-off-by: Josef Moravec --- Koha/REST/V1.pm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm index d62ee23..35d2bfb 100644 --- a/Koha/REST/V1.pm +++ b/Koha/REST/V1.pm @@ -91,6 +91,15 @@ sub authenticate_api_request { ) if $cookie and $action_spec->{'x-koha-authorization'}; } + # Check for malformed query parameters + my @errors; + my %valid_parameters = map { $_->{name} => 1 if $_->{in} eq 'query' } @{$action_spec->{parameters}}; + my $existing_params = $c->req->query_params->to_hash; + for my $param ( keys %{$existing_params} ) { + push @errors, { path => "/query/".$param, message => 'Malformed query string' } unless exists $valid_parameters{$param}; + } + return $c->render_swagger({},\@errors,400) if @errors; + return $next->($c) unless $action_spec->{'x-koha-authorization'}; unless ($user) { return $c->render_swagger({ error => "Authentication required." },{},401); -- 2.1.4