interagent / interagent/committee
Failing for garbage(URL encoded) value in query parameter
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 955
- Forks
- 145
- Avg merge
- 5d 4h
- Merged PRs (30d)
- 6
Description
I'm facing an issue with Request validation middleware.
I've following schema for one of my GET API endpoint
schema" : {
"maxLength" : 10,
"pattern" : "^[A-Z]+$",
"type" : "string",
"example" : "ABCDEF"
}
This is working fine for normal scenarios when I pass something like ABCDEFS or 123 it's giving expected output with error and status code of 4xx.
If I pass value like %2f%2e%2e%c0%af%2e%2e%2f%2e%2e%c0%af%2e%2e%2f%2e%2e%c0%af%2e%2e%2f%2e%2e%c0%af%2e%2e%2f%2e%2e%c0%af%2e%2e%2f%2e%2e%c0%af%2e%2e%2fetc%2fshadow then it's failing with status code of 5xx with error invalid byte sequence in UTF-8.
This should have returned a response like other invalid values but it's returning 5xx.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the request validation middleware and reproduce the issue using the URL-encoded query value from the report against the shown string schema. Trace how the invalid value is decoded and validated, then verify that it returns a 4xx response like other invalid values instead of a 5xx error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100