OData / OData/AspNetCoreOData

Model Validation Not Automatically Applied in OData Controller

Open
#1,107 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature P4
Dominant language
C#
Stars
505
Forks
186
PR merge metrics
No merged PRs in 30d

Description

Assemblies affected
ASP.NET Core OData 8.2.3

Describe the bug
The OData controller, specifically the CustomersController, is not automatically applying model validation to the key parameter in the Delete endpoint, despite having a model (Customer) with a MinLength validation attribute set for the Id property.

Reproduce steps

  1. Clone this repo https://github.com/Supernectar/ODataValidationAttributeBug and run the project
  2. Send a DELETE request to the /Customers endpoint with a key parameter that violates the MinLength validation constraint.
  3. Observe that the controller does not perform automatic model validation, and the request is processed without considering the validation attribute.

Data Model

public class Customer
{
    [MinLength(5)]
    public string? Id { get; set; }
    public string? Name { get; set; }
}

EDM (CSDL) Model

<?xml version="1.0" encoding="utf-8"?>
<edmx:Edmx Version="4.0" xmlns:edmx="http://docs.oasis-open.org/odata/ns/edmx">
    <edmx:DataServices>
        <Schema Namespace="WebApplication1" xmlns="http://docs.oasis-open.org/odata/ns/edm">
            <EntityType Name="Customer">
                <Key>
                    <PropertyRef Name="Id" />
                </Key>
                <Property Name="Id" Type="Edm.String" Nullable="false" />
                <Property Name="Name" Type="Edm.String" />
            </EntityType>
        </Schema>
        <Schema Namespace="Default" xmlns="http://docs.oasis-open.org/odata/ns/edm">
            <EntityContainer Name="Container">
                <EntitySet Name="Customers" EntityType="WebApplication1.Customer" />
            </EntityContainer>
        </Schema>
    </edmx:DataServices>
</edmx:Edmx>

Request/Response
Request Uri
https://localhost:7234/Customers/123
Response Body
200 OK

Expected behavior
The OData controller should automatically apply model validation to the key parameter based on the validation attributes specified in the corresponding model (Customer). Specifically, it should enforce the MinLength constraint for the Id property.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue using the linked ODataValidationAttributeBug project and its CustomersController Delete endpoint. Start with the Customer model's MinLength attribute and the key-binding path for DELETE /Customers/{key}; done means an invalid key is rejected through model validation rather than returning 200 OK.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.