Attachment 169838 Details for Bug 37018 – Bug 37018: Handle exception in unhandled_exception() helper

[patch] Bug 37018: Handle exception in unhandled_exception() helper

Bug-37018-Handle-exception-in-unhandledexception-h.patch (text/plain), 2.06 KB, created by Tomás Cohen Arazi (tcohen) on 2024-07-29 12:49:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2024-07-29 12:49:30 UTC

Size: 2.06 KB

patch

obsolete

>From 6a005d9313a3d94d14f9a8e7bc3b529c38bbd397 Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Mon, 8 Jul 2024 16:48:01 -0300
>Subject: [PATCH] Bug 37018: Handle exception in unhandled_exception() helper
>
>Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>
>Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>---
> Koha/REST/Plugin/Exceptions.pm | 10 ++++++++++
> t/db_dependent/api/v1/query.t  |  2 +-
> 2 files changed, 11 insertions(+), 1 deletion(-)
>
>diff --git a/Koha/REST/Plugin/Exceptions.pm b/Koha/REST/Plugin/Exceptions.pm
>index 3bf60c12311..22f0b314430 100644
>--- a/Koha/REST/Plugin/Exceptions.pm
>+++ b/Koha/REST/Plugin/Exceptions.pm
>@@ -59,6 +59,16 @@ sub register {
>             my $path   = $req->url->to_abs->path;
>             my $type = "";
> 
>+            if ( blessed $exception && ref($exception) eq 'Koha::Exceptions::REST::Query::InvalidOperator' ) {
>+                return $c->render(
>+                    status => 500,
>+                    json   => {
>+                        error      => printf( "Invalid operator in query: %s", $exception->operator ),
>+                        error_code => 'invalid_query',
>+                    }
>+                );
>+            }
>+
>             if ( blessed $exception ) {
>                 $type = "(" . ref($exception) . ")";
>             }
>diff --git a/t/db_dependent/api/v1/query.t b/t/db_dependent/api/v1/query.t
>index f807f21ea2b..353760ca996 100755
>--- a/t/db_dependent/api/v1/query.t
>+++ b/t/db_dependent/api/v1/query.t
>@@ -171,7 +171,7 @@ subtest 'SQL injection in "query" handling' => sub {
>         "[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
> 
>     $t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
>-        ->status_is( 400, 'Attempt to inject SQL through operators is rejected' );
>+        ->status_is( 500, 'Attempt to inject SQL through operators is rejected' );
> 
>     $schema->storage->txn_rollback;
> };
>-- 
>2.45.2

Actions: View | Diff | Splinter Review

Attachments on bug 37018: 167440 | 167441 | 167442 | 167446 | 167447 | 167448 | 167449 | 167603 | 167672 | 167691 | 167772 | 168458 | 168582 | 168583 | 168584 | 168585 | 168586 | 168587 | 168616 | 168617 | 168618 | 168619 | 168620 | 168621 | 168622 | 168624 | 168626 | 168627 | 168628 | 168629 | 168630 | 168631 | 168632 | 168633 | 168634 | 168635 | 168654 | 168655 | 168656 | 168657 | 168658 | 168659 | 168660 | 168661 | 168662 | 168695 | 168696 | 168697 | 168698 | 168699 | 168700 | 168701 | 168702 | 168703 | 168704 | 168786 | 168787 | 168788 | 168789 | 168790 | 168791 | 168792 | 168793 | 168794 | 168795 | 169309 | 169337 | 169338 | 169339 | 169340 | 169341 | 169342 | 169343 | 169344 | 169345 | 169346 | 169368 | 169369 | 169370 | 169371 | 169372 | 169373 | 169374 | 169375 | 169376 | 169377 | 169378 | 169414 | 169832 | 169833 | 169834 | 169835 | 169836 | 169837 | 169838 | 169839 | 169840 | 169841