OData / OData/AspNetCoreOData

$batch sub-request error on a dynamic data model architecture

Open
#1,609 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C#
Stars
505
Forks
186
PR merge metrics
No merged PRs in 30d

Description

Assemblies affected
ASP.NET Core OData 9.5.0

Describe the bug
Our project is structured like the ODataDynamicModel Sample from this repository which creates a dynamic route like this: [ref] options.Value.AddRouteComponents("/execution/{executionId}", EdmCoreModel.Instance);

On top of this dynamic model architecture we implemented the $batch functionality which I believe stopped working after updating from 9.4.1 to 9.5.0 due to the "Strengthen OData batch sub-request URL and header validation." part of the release.

After upgrading we get the following error message on our batch requests:
Error:The batch sub-request URI 'https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)' targets a path that is not within the OData service root 'https://[host]/execution/{executionId}.

Reproduce steps
Start from the ODataDynamicModel  sample, add odata batch and execute a batch request.

Data Model
Our data model is completely dynamic since it's defined by the application user.
It should be irrelevant since the request is failing before reaching any data model logic.

EDM (CSDL) Model
Irrelevant for the issue.

Request/Response
Request uri: https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)
Request body:
{
    "requests": [
        {
            "id": "1",
            "method": "GET",
            "url": "/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)"
        }
    ]
}
Response:
{
    "message": "Error:The batch sub-request URI 'https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)' targets a path that is not within the OData service root 'https://[host]/execution/{executionId}'. Batch sub-requests must address resources within the OData service.",
    "code": 500
}

Expected behavior
I would expect that the new security validation applied to batch sub-requests was capable of handling wildcards required for dynamic models on top of the currently applied checks.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with sample/ODataDynamicModel/Extensions/MyODataRoutingApplicationModelProvider.cs and reproduce the batch request described in the issue using the dynamic /execution/{executionId} route. Trace the strengthened batch sub-request URL validation introduced for 9.5.0; done means the shown dynamic route is accepted while the existing security checks remain effective.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.