Attachment 167441 Details for Bug 37018 – Bug 37018: Add validation method to Koha::REST::Plugin::Query.pm

[patch] Bug 37018: Add validation method to Koha::REST::Plugin::Query.pm

Bug-37018-Add-validation-method-to-KohaRESTPluginQ.patch (text/plain), 2.56 KB, created by Martin Renvoize (ashimema) on 2024-06-05 13:22:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2024-06-05 13:22:15 UTC

Size: 2.56 KB

patch

obsolete

>From 1a8fbaea91408c8744855801164eef420fef9321 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Wed, 5 Jun 2024 14:19:54 +0100
>Subject: [PATCH] Bug 37018: Add validation method to
> Koha::REST::Plugin::Query.pm
>
>---
> Koha/REST/Plugin/Query.pm | 65 +++++++++++++++++++++++++++++++++++++++
> 1 file changed, 65 insertions(+)
>
>diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm
>index 53decc94bcf..39fbe62b4a9 100644
>--- a/Koha/REST/Plugin/Query.pm
>+++ b/Koha/REST/Plugin/Query.pm
>@@ -187,6 +187,21 @@ Generates the DBIC join attribute based on extended_attributes query entries, an
>         }
>     );
> 
>+=head3 dbic_validate_operators
>+
>+    $attributes = $c->dbic_validate_operators({ filtered_params => $filtered_params });
>+
>+Validate operators in the passed query.
>+
>+=cut
>+
>+    $app->helper(
>+        'dbic_validate_operators' => sub {
>+            my ( $c, $args ) = @_;
>+            _validate_query($args->{filtered_params});
>+        }
>+    );
>+
> =head3 _build_query_params_from_api
> 
>     my $params = _build_query_params_from_api( $filtered_params, $reserved_params );
>@@ -641,4 +656,54 @@ sub _rewrite_related_metadata_query {
>     return $extended_attributes_entries;
> }
> 
>+=head3 _validate_operator
>+
>+=cut
>+
>+sub _validate_operator {
>+    my ($operator) = @_;
>+    my %allowed_operators = map { $_ => 1 } qw(= != < > <= >= like -not_like -in -ident -bool -not_bool -or);
>+    die "Invalid operator: $operator" unless exists $allowed_operators{$operator};
>+    return;
>+}
>+
>+=head3 _validate_query
>+
>+=cut
>+
>+sub _validate_query {
>+    my ($query) = @_;
>+
>+    if ( ref $query eq 'HASH' ) {
>+        for my $field ( keys %$query ) {
>+            my $value = $query->{$field};
>+
>+            if ( ref $value eq 'HASH' ) {
>+
>+                # Hash reference with operators
>+                for my $operator ( keys %$value ) {
>+                    _validate_operator($operator);
>+                }
>+            } elsif ( ref $value eq 'ARRAY' ) {
>+
>+                # Array reference with operator as the first element
>+                _validate_query($value);
>+            } else {
>+
>+                # Simple key-value pairs (no operator to validate)
>+            }
>+        }
>+    } elsif ( ref $query eq 'ARRAY' ) {
>+
>+        # Top-level OR combination or nested AND combination
>+        for my $element (@$query) {
>+            if ( ref $element eq 'ARRAY' && $element->[0] eq '-and' ) {
>+                _validate_query( $element->[1] );
>+            } else {
>+                _validate_query($element);
>+            }
>+        }
>+    }
>+}
>+
> 1;
>-- 
>2.45.1

Actions: View | Diff | Splinter Review

Attachments on bug 37018: 167440 | 167441 | 167442 | 167446 | 167447 | 167448 | 167449 | 167603 | 167672 | 167691 | 167772 | 168458 | 168582 | 168583 | 168584 | 168585 | 168586 | 168587 | 168616 | 168617 | 168618 | 168619 | 168620 | 168621 | 168622 | 168624 | 168626 | 168627 | 168628 | 168629 | 168630 | 168631 | 168632 | 168633 | 168634 | 168635 | 168654 | 168655 | 168656 | 168657 | 168658 | 168659 | 168660 | 168661 | 168662 | 168695 | 168696 | 168697 | 168698 | 168699 | 168700 | 168701 | 168702 | 168703 | 168704 | 168786 | 168787 | 168788 | 168789 | 168790 | 168791 | 168792 | 168793 | 168794 | 168795 | 169309 | 169337 | 169338 | 169339 | 169340 | 169341 | 169342 | 169343 | 169344 | 169345 | 169346 | 169368 | 169369 | 169370 | 169371 | 169372 | 169373 | 169374 | 169375 | 169376 | 169377 | 169378 | 169414 | 169832 | 169833 | 169834 | 169835 | 169836 | 169837 | 169838 | 169839 | 169840 | 169841