-
Notifications
You must be signed in to change notification settings - Fork 289
Description
Summary
When submitting a REST request on the DELETE endpoint, improper handling of the raised exception when a type fails to be parsed to the expected type results in an HTTP 500 error.
Reproduce
The following request uses curly braces "{}" instead of an integer. When Int32.TryParse() fails in ParseParamAsSystemType() in
data-api-builder/src/Service/Resolvers/Sql Query Structures/BaseSqlQueryStructure.cs
Lines 192 to 217 in 4787401
| ///<summary> | |
| /// Gets the value of the parameter cast as the system type | |
| /// of the column this parameter is associated with | |
| ///</summary> | |
| /// <exception cref="ArgumentException">columnName is not a valid column of table or param | |
| /// does not have a valid value type</exception> | |
| protected object GetParamAsColumnSystemType(string param, string columnName) | |
| { | |
| Type systemType = GetColumnSystemType(columnName); | |
| try | |
| { | |
| return ParseParamAsSystemType(param, systemType); | |
| } | |
| catch (Exception e) | |
| { | |
| if (e is FormatException || | |
| e is ArgumentNullException || | |
| e is OverflowException) | |
| { | |
| throw new ArgumentException($"Parameter \"{param}\" cannot be resolved as column \"{columnName}\" " + | |
| $"with type \"{systemType.Name}\"."); | |
| } | |
| throw; | |
| } | |
| } |
Other code paths which reference
GetParamAsColumnSystemType(string param, string columnName) catch the ArgumentException and translate to a DAB Exception with HTTP 400 Invalid request.
- DELETE
/api/Book/id/{} - Response:
'HTTP/1.1 500 Internal Server Error\r\nContent-Type: application/json; charset=utf-8\r\nDate: Tue, 27 Sep 2022 18:16:49 GMT\r\nServer: Kestrel\r\nTransfer-Encoding: chunked\r\n\r\n84\r\n{"error":{"code":"UnexpectedError","message":"While processing your request the server ran into an unexpected error.","status":500}}\r\n0\r\n\r\n'
Metadata
Metadata
Assignees
Labels
Type
Projects
Status