From 798b7d746246a6f8e2c35ce22fae9bb351f706b7 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Fri, 14 Oct 2016 08:57:30 +0000 Subject: [PATCH] Bug 17445: Add 'malformed query' error response This patch adds to the x-mojo-around action code to give a meaningful error given a bad query parameter in the query string for a request. Test Plan 1) Submit an api request to an existing restful endpoint with no query parameters 2) Confirm the correct response is being given 3) Submit an api request to an existing restful endpoint with an allowed query parameter 4) Confimr the correct response is being given 5) Submit an api request to an existing restful endpoint with a malformed query paramter 6) Note the 400 response code and helpful json api body https://bugs.koha-community.org/show_bug.cgi?id=17445 Signed-off-by: Josef Moravec Signed-off-by: Tomas Cohen Arazi --- Koha/REST/V1.pm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Koha/REST/V1.pm b/Koha/REST/V1.pm index d62ee23..35d2bfb 100644 --- a/Koha/REST/V1.pm +++ b/Koha/REST/V1.pm @@ -91,6 +91,15 @@ sub authenticate_api_request { ) if $cookie and $action_spec->{'x-koha-authorization'}; } + # Check for malformed query parameters + my @errors; + my %valid_parameters = map { $_->{name} => 1 if $_->{in} eq 'query' } @{$action_spec->{parameters}}; + my $existing_params = $c->req->query_params->to_hash; + for my $param ( keys %{$existing_params} ) { + push @errors, { path => "/query/".$param, message => 'Malformed query string' } unless exists $valid_parameters{$param}; + } + return $c->render_swagger({},\@errors,400) if @errors; + return $next->($c) unless $action_spec->{'x-koha-authorization'}; unless ($user) { return $c->render_swagger({ error => "Authentication required." },{},401); -- 2.10.1