From 462a821740357861528a3bed4f9428ff7c0a4a8d Mon Sep 17 00:00:00 2001
From: PGijsbers <p.gijsbers@tue.nl>
Date: Tue, 4 Aug 2026 16:09:12 +0200
Subject: [PATCH] Whitelist specific functions, provide clearer error codes

---
 openml_OS/controllers/Data.php | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/openml_OS/controllers/Data.php b/openml_OS/controllers/Data.php
index 402a501db..36d511281 100644
--- a/openml_OS/controllers/Data.php
+++ b/openml_OS/controllers/Data.php
@@ -54,6 +54,26 @@ private function bootstrap($version) {
     $controller = array_shift($segs);
     $this->version = array_shift($segs);
     $function = array_shift($segs);
+
+    $function_whitelist = array('download', 'view', 'get_csv');
+
+    if (!in_array($function, $function_whitelist)) {
+      http_response_code(404);
+      echo 'Function not valid.';
+      return;
+    }
+
+    if (!$segs) {
+      http_response_code(400);
+      echo 'Missing value for argument id.';
+      return;
+    }
+
+    if (count($segs) > 2) {
+      http_response_code(400);
+      echo 'Expected at most two arguments: id (required) and name (optional).';
+      return;
+    }
     
     call_user_func_array(array($this->Data_server, $function), $segs);
   }