View | Details | Raw Unified | Return to bug 37018
Collapse All | Expand All

(-)a/Koha/REST/Plugin/Exceptions.pm (-1 / +1 lines)
Lines 61-67 sub register { Link Here
61
61
62
            if ( blessed $exception && ref($exception) eq 'Koha::Exceptions::REST::Query::InvalidOperator' ) {
62
            if ( blessed $exception && ref($exception) eq 'Koha::Exceptions::REST::Query::InvalidOperator' ) {
63
                return $c->render(
63
                return $c->render(
64
                    status => 500,
64
                    status => 400,
65
                    json   => {
65
                    json   => {
66
                        error      => printf( "Invalid operator in query: %s", $exception->operator ),
66
                        error      => printf( "Invalid operator in query: %s", $exception->operator ),
67
                        error_code => 'invalid_query',
67
                        error_code => 'invalid_query',
(-)a/api/v1/swagger/paths/cities.yaml (+7 lines)
Lines 43-48 Link Here
43
          type: array
43
          type: array
44
          items:
44
          items:
45
            $ref: "../swagger.yaml#/definitions/city"
45
            $ref: "../swagger.yaml#/definitions/city"
46
      "400":
47
        description: |
48
          Bad request. Possible `error_code` attribute values:
49
50
            * `invalid_query`
51
        schema:
52
          $ref: "../swagger.yaml#/definitions/error"
46
      "403":
53
      "403":
47
        description: Access forbidden
54
        description: Access forbidden
48
        schema:
55
        schema:
(-)a/api/v1/swagger/paths/patrons.yaml (+7 lines)
Lines 372-377 Link Here
372
          type: array
372
          type: array
373
          items:
373
          items:
374
            $ref: "../swagger.yaml#/definitions/patron"
374
            $ref: "../swagger.yaml#/definitions/patron"
375
      "400":
376
        description: |
377
          Bad request. Possible `error_code` attribute values:
378
379
            * `invalid_query`
380
        schema:
381
          $ref: "../swagger.yaml#/definitions/error"
375
      "401":
382
      "401":
376
        description: Authentication required
383
        description: Authentication required
377
        schema:
384
        schema:
(-)a/api/v1/swagger/paths/preservation_trains.yaml (-6 / +29 lines)
Lines 62-69 Link Here
62
          items:
62
          items:
63
            $ref: "../swagger.yaml#/definitions/preservation_train"
63
            $ref: "../swagger.yaml#/definitions/preservation_train"
64
          type: array
64
          type: array
65
      400:
65
      "400":
66
        description: Bad request
66
        description: |
67
          Bad request. Possible `error_code` attribute values:
68
69
            * `invalid_query`
67
        schema:
70
        schema:
68
          $ref: "../swagger.yaml#/definitions/error"
71
          $ref: "../swagger.yaml#/definitions/error"
69
      403:
72
      403:
Lines 178-183 Link Here
178
        schema:
181
        schema:
179
          items:
182
          items:
180
            $ref: "../swagger.yaml#/definitions/preservation_train"
183
            $ref: "../swagger.yaml#/definitions/preservation_train"
184
      "400":
185
        description: |
186
          Bad request. Possible `error_code` attribute values:
187
188
            * `invalid_query`
189
        schema:
190
          $ref: "../swagger.yaml#/definitions/error"
181
      401:
191
      401:
182
        description: Authentication required
192
        description: Authentication required
183
        schema:
193
        schema:
Lines 228-235 Link Here
228
        schema:
238
        schema:
229
          items:
239
          items:
230
            $ref: "../swagger.yaml#/definitions/preservation_train"
240
            $ref: "../swagger.yaml#/definitions/preservation_train"
231
      400:
241
      "400":
232
        description: Bad parameter
242
        description: |
243
          Bad request. Possible `error_code` attribute values:
244
245
            * `invalid_query`
233
        schema:
246
        schema:
234
          $ref: "../swagger.yaml#/definitions/error"
247
          $ref: "../swagger.yaml#/definitions/error"
235
      403:
248
      403:
Lines 399-406 Link Here
399
          type: array
412
          type: array
400
          items:
413
          items:
401
            type: object
414
            type: object
402
      400:
415
      "400":
403
        description: Bad parameter
416
        description: |
417
          Bad request. Possible `error_code` attribute values:
418
419
            * `invalid_query`
404
        schema:
420
        schema:
405
          $ref: "../swagger.yaml#/definitions/error"
421
          $ref: "../swagger.yaml#/definitions/error"
406
      401:
422
      401:
Lines 578-583 Link Here
578
        description: An item in train
594
        description: An item in train
579
        schema:
595
        schema:
580
          $ref: "../swagger.yaml#/definitions/preservation_train_item"
596
          $ref: "../swagger.yaml#/definitions/preservation_train_item"
597
      "400":
598
        description: |
599
          Bad request. Possible `error_code` attribute values:
600
601
            * `invalid_query`
602
        schema:
603
          $ref: "../swagger.yaml#/definitions/error"
581
      401:
604
      401:
582
        description: Authentication required
605
        description: Authentication required
583
        schema:
606
        schema:
(-)a/api/v1/swagger/paths/preservation_waiting_list.yaml (-1 / +4 lines)
Lines 41-47 Link Here
41
          items:
41
          items:
42
            $ref: "../swagger.yaml#/definitions/item"
42
            $ref: "../swagger.yaml#/definitions/item"
43
      "400":
43
      "400":
44
        description: Bad parameter
44
        description: |
45
          Bad request. Possible `error_code` attribute values:
46
47
            * `invalid_query`
45
        schema:
48
        schema:
46
          $ref: "../swagger.yaml#/definitions/error"
49
          $ref: "../swagger.yaml#/definitions/error"
47
      "401":
50
      "401":
(-)a/api/v1/swagger/paths/public_oauth.yaml (-2 / +5 lines)
Lines 63-71 Link Here
63
        schema:
63
        schema:
64
          type: string
64
          type: string
65
      "400":
65
      "400":
66
        description: Bad Request
66
        description: |
67
          Bad request. Possible `error_code` attribute values:
68
69
            * `invalid_query`
67
        schema:
70
        schema:
68
          $ref: ../swagger.yaml#/definitions/error
71
          $ref: "../swagger.yaml#/definitions/error"
69
      "403":
72
      "403":
70
        description: Access forbidden
73
        description: Access forbidden
71
        schema:
74
        schema:
(-)a/api/v1/swagger/paths/quotes.yaml (+14 lines)
Lines 43-48 Link Here
43
          type: array
43
          type: array
44
          items:
44
          items:
45
            $ref: "../swagger.yaml#/definitions/quote"
45
            $ref: "../swagger.yaml#/definitions/quote"
46
      "400":
47
        description: |
48
          Bad request. Possible `error_code` attribute values:
49
50
            * `invalid_query`
51
        schema:
52
          $ref: "../swagger.yaml#/definitions/error"
46
      "403":
53
      "403":
47
        description: Access forbidden
54
        description: Access forbidden
48
        schema:
55
        schema:
Lines 119-124 Link Here
119
        description: A Quote
126
        description: A Quote
120
        schema:
127
        schema:
121
          $ref: "../swagger.yaml#/definitions/quote"
128
          $ref: "../swagger.yaml#/definitions/quote"
129
      "400":
130
        description: |
131
          Bad request. Possible `error_code` attribute values:
132
133
            * `invalid_query`
134
        schema:
135
          $ref: "../swagger.yaml#/definitions/error"
122
      "404":
136
      "404":
123
        description: Quote not found
137
        description: Quote not found
124
        schema:
138
        schema:
(-)a/api/v1/swagger/paths/record_sources.yaml (-2 / +8 lines)
Lines 25-31 Link Here
25
          items:
25
          items:
26
            $ref: "../swagger.yaml#/definitions/record_source"
26
            $ref: "../swagger.yaml#/definitions/record_source"
27
      "400":
27
      "400":
28
        description: Missing or wrong parameters
28
        description: |
29
          Bad request. Possible `error_code` attribute values:
30
31
            * `invalid_query`
29
        schema:
32
        schema:
30
          $ref: "../swagger.yaml#/definitions/error"
33
          $ref: "../swagger.yaml#/definitions/error"
31
      "401":
34
      "401":
Lines 117-123 Link Here
117
        schema:
120
        schema:
118
          $ref: "../swagger.yaml#/definitions/record_source"
121
          $ref: "../swagger.yaml#/definitions/record_source"
119
      "400":
122
      "400":
120
        description: Missing or wrong parameters
123
        description: |
124
          Bad request. Possible `error_code` attribute values:
125
126
            * `invalid_query`
121
        schema:
127
        schema:
122
          $ref: "../swagger.yaml#/definitions/error"
128
          $ref: "../swagger.yaml#/definitions/error"
123
      "401":
129
      "401":
(-)a/api/v1/swagger/paths/rotas.yaml (+14 lines)
Lines 23-28 Link Here
23
          type: array
23
          type: array
24
          items:
24
          items:
25
            $ref: "../swagger.yaml#/definitions/rota"
25
            $ref: "../swagger.yaml#/definitions/rota"
26
      "400":
27
        description: |
28
          Bad request. Possible `error_code` attribute values:
29
30
            * `invalid_query`
31
        schema:
32
          $ref: "../swagger.yaml#/definitions/error"
26
      "403":
33
      "403":
27
        description: Access forbidden
34
        description: Access forbidden
28
        schema:
35
        schema:
Lines 99-104 Link Here
99
        description: A rota
106
        description: A rota
100
        schema:
107
        schema:
101
          $ref: "../swagger.yaml#/definitions/rota"
108
          $ref: "../swagger.yaml#/definitions/rota"
109
      "400":
110
        description: |
111
          Bad request. Possible `error_code` attribute values:
112
113
            * `invalid_query`
114
        schema:
115
          $ref: "../swagger.yaml#/definitions/error"
102
      "404":
116
      "404":
103
        description: Rota not found
117
        description: Rota not found
104
        schema:
118
        schema:
(-)a/api/v1/swagger/paths/search_filters.yaml (+14 lines)
Lines 23-28 Link Here
23
          type: array
23
          type: array
24
          items:
24
          items:
25
            $ref: "../swagger.yaml#/definitions/search_filter"
25
            $ref: "../swagger.yaml#/definitions/search_filter"
26
      "400":
27
        description: |
28
          Bad request. Possible `error_code` attribute values:
29
30
            * `invalid_query`
31
        schema:
32
          $ref: "../swagger.yaml#/definitions/error"
26
      '403':
33
      '403':
27
        description: Access forbidden
34
        description: Access forbidden
28
        schema:
35
        schema:
Lines 97-102 Link Here
97
        description: A search filter
104
        description: A search filter
98
        schema:
105
        schema:
99
          $ref: "../swagger.yaml#/definitions/search_filter"
106
          $ref: "../swagger.yaml#/definitions/search_filter"
107
      "400":
108
        description: |
109
          Bad request. Possible `error_code` attribute values:
110
111
            * `invalid_query`
112
        schema:
113
          $ref: "../swagger.yaml#/definitions/error"
100
      '403':
114
      '403':
101
        description: Access forbidden
115
        description: Access forbidden
102
        schema:
116
        schema:
(-)a/api/v1/swagger/paths/suggestions.yaml (+21 lines)
Lines 24-29 Link Here
24
          type: array
24
          type: array
25
          items:
25
          items:
26
            $ref: "../swagger.yaml#/definitions/suggestion"
26
            $ref: "../swagger.yaml#/definitions/suggestion"
27
      "400":
28
        description: |
29
          Bad request. Possible `error_code` attribute values:
30
31
            * `invalid_query`
32
        schema:
33
          $ref: "../swagger.yaml#/definitions/error"
27
      "403":
34
      "403":
28
        description: Access forbidden
35
        description: Access forbidden
29
        schema:
36
        schema:
Lines 118-123 Link Here
118
        description: A suggestion
125
        description: A suggestion
119
        schema:
126
        schema:
120
          $ref: "../swagger.yaml#/definitions/suggestion"
127
          $ref: "../swagger.yaml#/definitions/suggestion"
128
      "400":
129
        description: |
130
          Bad request. Possible `error_code` attribute values:
131
132
            * `invalid_query`
133
        schema:
134
          $ref: "../swagger.yaml#/definitions/error"
121
      "403":
135
      "403":
122
        description: Access forbidden
136
        description: Access forbidden
123
        schema:
137
        schema:
Lines 264-269 Link Here
264
          type: array
278
          type: array
265
          items:
279
          items:
266
            $ref: "../swagger.yaml#/definitions/patron"
280
            $ref: "../swagger.yaml#/definitions/patron"
281
      "400":
282
        description: |
283
          Bad request. Possible `error_code` attribute values:
284
285
            * `invalid_query`
286
        schema:
287
          $ref: "../swagger.yaml#/definitions/error"
267
      "403":
288
      "403":
268
        description: Access forbidden
289
        description: Access forbidden
269
        schema:
290
        schema:
(-)a/api/v1/swagger/paths/tickets.yaml (+21 lines)
Lines 38-43 Link Here
38
          type: array
38
          type: array
39
          items:
39
          items:
40
            $ref: "../swagger.yaml#/definitions/ticket"
40
            $ref: "../swagger.yaml#/definitions/ticket"
41
      "400":
42
        description: |
43
          Bad request. Possible `error_code` attribute values:
44
45
            * `invalid_query`
46
        schema:
47
          $ref: "../swagger.yaml#/definitions/error"
41
      "403":
48
      "403":
42
        description: Access forbidden
49
        description: Access forbidden
43
        schema:
50
        schema:
Lines 114-119 Link Here
114
        description: A ticket
121
        description: A ticket
115
        schema:
122
        schema:
116
          $ref: "../swagger.yaml#/definitions/ticket"
123
          $ref: "../swagger.yaml#/definitions/ticket"
124
      "400":
125
        description: |
126
          Bad request. Possible `error_code` attribute values:
127
128
            * `invalid_query`
129
        schema:
130
          $ref: "../swagger.yaml#/definitions/error"
117
      "404":
131
      "404":
118
        description: Ticket not found
132
        description: Ticket not found
119
        schema:
133
        schema:
Lines 249-254 Link Here
249
          type: array
263
          type: array
250
          items:
264
          items:
251
            $ref: "../swagger.yaml#/definitions/ticket_update"
265
            $ref: "../swagger.yaml#/definitions/ticket_update"
266
      "400":
267
        description: |
268
          Bad request. Possible `error_code` attribute values:
269
270
            * `invalid_query`
271
        schema:
272
          $ref: "../swagger.yaml#/definitions/error"
252
      "403":
273
      "403":
253
        description: Access forbidden
274
        description: Access forbidden
254
        schema:
275
        schema:
(-)a/api/v1/swagger/paths/transfer_limits.yaml (-1 / +4 lines)
Lines 44-50 Link Here
44
          items:
44
          items:
45
            $ref: "../swagger.yaml#/definitions/transfer_limit"
45
            $ref: "../swagger.yaml#/definitions/transfer_limit"
46
      "400":
46
      "400":
47
        description: Bad request
47
        description: |
48
          Bad request. Possible `error_code` attribute values:
49
50
            * `invalid_query`
48
        schema:
51
        schema:
49
          $ref: "../swagger.yaml#/definitions/error"
52
          $ref: "../swagger.yaml#/definitions/error"
50
      "401":
53
      "401":
(-)a/t/db_dependent/api/v1/query.t (-1 / +1 lines)
Lines 171-177 subtest 'SQL injection in "query" handling' => sub { Link Here
171
        "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
171
        "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
172
172
173
    $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
173
    $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
174
        ->status_is( 500, 'Attempt to inject SQL through operators is rejected' );
174
        ->status_is( 400, 'Attempt to inject SQL through operators is rejected' );
175
175
176
    $schema->storage->txn_rollback;
176
    $schema->storage->txn_rollback;
177
};
177
};
(-)a/xt/api.t (-2 / +33 lines)
Lines 14-20 Link Here
14
14
15
use Modern::Perl;
15
use Modern::Perl;
16
16
17
use Test::More tests => 4;
17
use Test::More tests => 5;
18
18
19
use Test::Mojo;
19
use Test::Mojo;
20
use Data::Dumper;
20
use Data::Dumper;
Lines 128-130 subtest 'tags tests' => sub { Link Here
128
        print STDERR "$error\n";
128
        print STDERR "$error\n";
129
    }
129
    }
130
};
130
};
131
- 
131
132
subtest '400 response tests' => sub {
133
134
    plan tests => 1;
135
136
    my @errors;
137
138
    foreach my $route ( sort keys %{$paths} ) {
139
        foreach my $verb ( keys %{ $paths->{$route} } ) {
140
141
            next unless $verb eq 'get';
142
143
            my $response_400 = $paths->{$route}->{$verb}->{responses}->{400};
144
145
            push @errors, "$verb $route -> 'description' does not include 'Bad request': ($response_400->{description})"
146
                unless $response_400->{description} =~ /^Bad request/;
147
148
            push @errors,
149
                "$verb $route -> 'description' does not include '* invalid_query': ($response_400->{description})"
150
                unless $response_400->{description} =~ /\* \`invalid_query\`/;
151
152
            push @errors, "$verb $route -> '\$ref' is not '#/definitions/error'"
153
                unless $response_400->{schema}->{'$ref'} eq '#/definitions/error';
154
        }
155
    }
156
157
    is( scalar @errors, 0, 'No 400 definitions missing for GET in the spec' );
158
159
    foreach my $error (@errors) {
160
        print STDERR "$error\n";
161
    }
162
};

Return to bug 37018