Return a validation error when query string is malformed (#3488)

* Return a validation error when query string is malformed for map parameters. * Properly handle maps with no validation
goadesign · Mar 9, 2024 · 6570900 · 6570900
1 parent c953c5a
commit 6570900
Show file tree

Hide file tree

Showing 4 changed files with 222 additions and 94 deletions.
diff --git a/http/codegen/service_data.go b/http/codegen/service_data.go
@@ -1067,7 +1067,7 @@ func buildPayloadData(e *expr.HTTPEndpointExpr, sd *ServiceData) *PayloadData {
 			}
 			if !mustValidate {
 				for _, q := range queryData {
-					if q.Validate != "" || q.Required || needConversion(q.Type) {
+					if q.Map || q.Validate != "" || q.Required || needConversion(q.Type) {
 						mustValidate = true
 						break
 					}

diff --git a/http/codegen/templates/partial/query_map_conversion.go.tpl b/http/codegen/templates/partial/query_map_conversion.go.tpl
@@ -5,6 +5,9 @@
 	{
 		openIdx := strings.IndexRune(keyRaw, '[')
 		closeIdx := strings.IndexRune(keyRaw, ']')
+		if closeIdx == -1 {
+			err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
+		} else {
 	{{- if eq .Type.KeyType.Type.Name "string" }}
 		key{{ .Loop }} = keyRaw[openIdx+1 : closeIdx]
 	{{- else }}
@@ -14,6 +17,7 @@
 		{{- if gt .Depth 0 }}
 			keyRaw = keyRaw[closeIdx+1:]
 		{{- end }}
+		}
 	}
 	{{- if eq .Type.ElemType.Type.Name "string" }}
 		{{ .VarName }}[key{{ .Loop }}] = valRaw[0]

diff --git a/http/codegen/testdata/multipart_code.go b/http/codegen/testdata/multipart_code.go
@@ -161,12 +161,16 @@ func NewServiceMultipartWithParamMethodMultipartWithParamDecoder(mux goahttp.Mux
 						{
 							openIdx := strings.IndexRune(keyRaw, '[')
 							closeIdx := strings.IndexRune(keyRaw, ']')
-							keyaRaw := keyRaw[openIdx+1 : closeIdx]
-							v, err2 := strconv.ParseInt(keyaRaw, 10, strconv.IntSize)
-							if err2 != nil {
-								err = goa.MergeErrors(err, goa.InvalidFieldTypeError("query", keyaRaw, "integer"))
+							if closeIdx == -1 {
+								err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
+							} else {
+								keyaRaw := keyRaw[openIdx+1 : closeIdx]
+								v, err2 := strconv.ParseInt(keyaRaw, 10, strconv.IntSize)
+								if err2 != nil {
+									err = goa.MergeErrors(err, goa.InvalidFieldTypeError("query", keyaRaw, "integer"))
+								}
+								keya = int(v)
 							}
-							keya = int(v)
 						}
 						c2[keya] = valRaw
 					}
@@ -221,12 +225,16 @@ func NewServiceMultipartWithParamsAndHeadersMethodMultipartWithParamsAndHeadersD
 						{
 							openIdx := strings.IndexRune(keyRaw, '[')
 							closeIdx := strings.IndexRune(keyRaw, ']')
-							keyaRaw := keyRaw[openIdx+1 : closeIdx]
-							v, err2 := strconv.ParseInt(keyaRaw, 10, strconv.IntSize)
-							if err2 != nil {
-								err = goa.MergeErrors(err, goa.InvalidFieldTypeError("query", keyaRaw, "integer"))
+							if closeIdx == -1 {
+								err = goa.MergeErrors(err, goa.DecodePayloadError("invalid query string: missing closing bracket"))
+							} else {
+								keyaRaw := keyRaw[openIdx+1 : closeIdx]
+								v, err2 := strconv.ParseInt(keyaRaw, 10, strconv.IntSize)
+								if err2 != nil {
+									err = goa.MergeErrors(err, goa.InvalidFieldTypeError("query", keyaRaw, "integer"))
+								}
+								keya = int(v)
 							}
-							keya = int(v)
 						}
 						c2[keya] = valRaw
 					}