[
https://issues.apache.org/jira/browse/FINERACT-2935?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126733#comment-18126733
]
raashed edited comment on FINERACT-2935 at 10/13/26 1:14 PM:
-------------------------------------------------------------
[~aleks] , [~adamsaghy] I'd like to work on this one. The fix I have in mind is
small: make {{ContentPolicyException}} extend
{{{}PlatformApiDataValidationException{}}}, so a rejected upload returns 400
with the policy message (e.g. "Detected mime type text/plain ... not allowed!")
on the {{file}} parameter instead of a 500. Plus a unit test for the mapping
and an integration test in {{FeignDocumentTest}} that uploads a .txt and
expects 400.
One question: would you prefer 400 (validation error) or 403 like the other
domain-rule exceptions? Image uploads already wrap this exception in
{{DocumentInvalidRequestException}} (403), so 403 would be consistent with that
path, though 400 seemed more accurate for bad input. Happy to go either way.
was (Author: JIRAUSER314999):
[~alekstorm], [~adamsaghy] I'd like to work on this one. The fix I have in mind
is small: make \{{ContentPolicyException}} extend
\{{PlatformApiDataValidationException}}, so a rejected upload returns 400 with
the policy message (e.g. "Detected mime type text/plain ... not allowed!") on
the \{{file}} parameter instead of a 500. Plus a unit test for the mapping and
an integration test in \{{FeignDocumentTest}} that uploads a .txt and expects
400.
One question: would you prefer 400 (validation error) or 403 like the other
domain-rule exceptions? Image uploads already wrap this exception in
\{{DocumentInvalidRequestException}} (403), so 403 would be consistent with
that path, though 400 seemed more accurate for bad input. Happy to go either
way.
> Document upload returns HTTP 500 when a content policy rejects the file
> (e.g. disallowed file type)
> ----------------------------------------------------------------------------------------------------
>
> Key: FINERACT-2935
> URL: https://issues.apache.org/jira/browse/FINERACT-2935
> Project: Apache Fineract
> Issue Type: Bug
> Components: System
> Affects Versions: 1.15.0
> Reporter: raashed
> Priority: Minor
>
> Uploading a document whose file type is not on the whitelist (e.g. a
> \{{.txt}} file to \{{POST /v1/clients/{clientId}/documents}}) is correctly
> rejected by \{{WhitelistContentPolicy}}, but the API responds with *HTTP 500*
> instead of a client error.
> *Cause*
> {\{ContentPolicyException}} (fineract-document,
> \{{infrastructure.contentstore.exception}}) extends the bare
> \{{AbstractPlatformException}}, which has no dedicated exception mapper, so
> it falls through to \{{DefaultExceptionMapper}}, which always returns 500.
> This affects every content policy that throws it:
> * \{{WhitelistContentPolicy}} (file name / mime type not allowed)
> * \{{MimeContentPolicy}} (declared vs. detected mime type mismatch)
> * \{{TraversalContentPolicy}} (path traversal)
> *Expected*
> A 4xx response with a message saying why the file was rejected (e.g. 400 as a
> validation error).
> *Proposed fix*
> Make \{{ContentPolicyException}} map to a 4xx response, and add
> unit/integration tests covering a rejected upload.
> I'd like to work on this.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
