apache / apache/cloudstack

Leading/trailing spaces are allowed in string fields for some API endpoints

未关闭
#12,506 7 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
component:api type:improvement
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

### problem

Currently, some API endpoints allow saving string fields with leading or trailing spaces. This behavior can lead to inconsistent data and unexpected UI/API issues.

For example, when creating or updating certain resources (e.g. volumes, templates, ISOs), values with spaces at the beginning or end of the string are accepted and stored successfully, while they should instead be rejected with a validation error.

Here is the list of API endpoints where the issue occurs for the name and description fields:
- registerIso / updateIso
- createVolume / updateVolume / uploadVolume
- registerTemplate / updateTemplate
- updateNetwork / createNetwork / createNetworkACL / updateNetworkACLList
- createVPC / updateVPC
- createVpnCustomerGateway / createVpnGateway / createVpnCustomerGateway

Please also check other endpoints where this issue might occur, as similar validation problems may exist elsewhere.

### versions

CloudStack 4.20.2.0

### The steps to reproduce the bug

1. Call one of the affected endpoints (for example: ISO creation or update).
2. Provide string fields with leading or trailing spaces.
3. Observe that the request is accepted and the data is stored.

```
{
"listisosresponse": {
"count": 1,
"iso": [
{
"id": "fee7a4be-b9cd-41d9-81c9-e948332e605b",
"name": " test name ",
"displaytext": " text ",
"isready": true,
"url": "my_url",
....
}
]
}
}
```

### What to do about it?

The API should not allow leading or trailing spaces in string fields. It would be preferable to introduce this validation globally for all string fields across the API

贡献指南

打开贡献指南

调研方向

首先跟踪所列 API 入口点的验证流程,使用 registerIso 或 updateIso 重现接受前导和尾随空格的情况。检查其他列出的 volume、template、network、VPC 和 VPN 端点是否存在相同的行为;当受影响的字符串字段通过验证错误拒绝此类值时即视为完成,包括发现的任何其他端点。

由索引模型根据 Issue 内容生成。

评估

技术栈
java
领域
api, backend, cloud
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。