apache / apache/cloudstack

Leading/trailing spaces are allowed in string fields for some API endpoints

Open
#12,506 7 comments 0 reactions 0 assignees View on GitHub
component:api type:improvement
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

### problem

Currently, some API endpoints allow saving string fields with leading or trailing spaces. This behavior can lead to inconsistent data and unexpected UI/API issues.

For example, when creating or updating certain resources (e.g. volumes, templates, ISOs), values with spaces at the beginning or end of the string are accepted and stored successfully, while they should instead be rejected with a validation error.

Here is the list of API endpoints where the issue occurs for the name and description fields:
- registerIso / updateIso
- createVolume / updateVolume / uploadVolume
- registerTemplate / updateTemplate
- updateNetwork / createNetwork / createNetworkACL / updateNetworkACLList
- createVPC / updateVPC
- createVpnCustomerGateway / createVpnGateway / createVpnCustomerGateway

Please also check other endpoints where this issue might occur, as similar validation problems may exist elsewhere.

### versions

CloudStack 4.20.2.0

### The steps to reproduce the bug

1. Call one of the affected endpoints (for example: ISO creation or update).
2. Provide string fields with leading or trailing spaces.
3. Observe that the request is accepted and the data is stored.

```
{
"listisosresponse": {
"count": 1,
"iso": [
{
"id": "fee7a4be-b9cd-41d9-81c9-e948332e605b",
"name": " test name ",
"displaytext": " text ",
"isready": true,
"url": "my_url",
....
}
]
}
}
```

### What to do about it?

The API should not allow leading or trailing spaces in string fields. It would be preferable to introduce this validation globally for all string fields across the API

Contributor guide

Open the contributing guide

Research direction

Start by tracing validation for the listed API entry points, using registerIso or updateIso to reproduce acceptance of leading and trailing spaces. Check the other named volume, template, network, VPC, and VPN endpoints for the same behavior; done means affected string fields reject such values with a validation error, including any additional endpoints found.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.