Altinn / Altinn/app-lib-dotnet
Get data API call does not take app information into account when responding
- Dominant language
- C#
- Stars
- 8
- Forks
- 27
- Avg merge
- 1h 21m
- Merged PRs (30d)
- 7
Description
### Description of the bug
It is possible to look up instance data from a different app and it will be serialized into the wrong model
### Steps To Reproduce
Prerequisites:
- A valid API token
- Two apps (APP1, APP2) with different models
How to reproduce:
1. Create an instance in the altinn3 gui on **APP1**
2. Identify the needed information by inspecting network or lookup in API (org, APP1, APP2, partyid, instanceid, dataid)
4. Do a GET request to https://{org}.apps.tt02.altinn.no/{org}/**{APP2]**/instances/{partyId}/{instanceId}/data/{dataId}
5. Observe that you get 200 OK and the wrong model
Expected result:
404 Not found
### Additional Information
_No response_
Contributor guide
Research direction
Reproduce the GET request against APP1 and APP2 using the endpoint and prerequisites in the issue, confirming whether APP2 returns APP1 data with 200 OK. Trace that request through app-lib-dotnet's API handling; done means a cross-app lookup returns 404 Not Found instead of serializing the data into the wrong model.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100