raashed created FINERACT-2935:
---------------------------------
Summary: Document upload returns HTTP 500 when a content policy
rejects the file (e.g. disallowed file type)
Key: FINERACT-2935
URL: https://issues.apache.org/jira/browse/FINERACT-2935
Project: Apache Fineract
Issue Type: Bug
Components: System
Affects Versions: 1.15.0
Reporter: raashed
Uploading a document whose file type is not on the whitelist (e.g. a \{{.txt}}
file to \{{POST /v1/clients/{clientId}/documents}}) is correctly rejected by
\{{WhitelistContentPolicy}}, but the API responds with *HTTP 500* instead of a
client error.
*Cause*
{\{ContentPolicyException}} (fineract-document,
\{{infrastructure.contentstore.exception}}) extends the bare
\{{AbstractPlatformException}}, which has no dedicated exception mapper, so it
falls through to \{{DefaultExceptionMapper}}, which always returns 500. This
affects every content policy that throws it:
* \{{WhitelistContentPolicy}} (file name / mime type not allowed)
* \{{MimeContentPolicy}} (declared vs. detected mime type mismatch)
* \{{TraversalContentPolicy}} (path traversal)
*Expected*
A 4xx response with a message saying why the file was rejected (e.g. 400 as a
validation error).
*Proposed fix*
Make \{{ContentPolicyException}} map to a 4xx response, and add
unit/integration tests covering a rejected upload.
I'd like to work on this.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
