[
https://issues.apache.org/jira/browse/FINERACT-2935?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
raashed updated FINERACT-2935:
------------------------------
Description:
Uploading a document whose file type is not on the whitelist (e.g. a {{.txt}}
file to \{{POST /v1/clients/<clientId>/documents}} is correctly rejected by
{{{}WhitelistContentPolicy{}}}, but the API responds with *HTTP 500* instead of
a client error.
*Cause*
{{ContentPolicyException}} (fineract-document,
{{{}infrastructure.contentstore.exception{}}}) extends the bare
{{{}AbstractPlatformException{}}}, which has no dedicated exception mapper, so
it falls through to {{{}DefaultExceptionMapper{}}}, which always returns 500.
This affects every content policy that throws it:
* {{WhitelistContentPolicy}} (file name / mime type not allowed)
* {{MimeContentPolicy}} (declared vs. detected mime type mismatch)
* {{TraversalContentPolicy}} (path traversal)
*Expected*
A 4xx response with a message saying why the file was rejected (e.g. 400 as a
validation error).
*Proposed fix*
Make {{ContentPolicyException}} map to a 4xx response, and add unit/integration
tests covering a rejected upload.
I'd like to work on this.
was:
Uploading a document whose file type is not on the whitelist (e.g. a \{{.txt}}
file to \{{POST /v1/clients/{clientId}/documents}}) is correctly rejected by
\{{WhitelistContentPolicy}}, but the API responds with *HTTP 500* instead of a
client error.
*Cause*
{\{ContentPolicyException}} (fineract-document,
\{{infrastructure.contentstore.exception}}) extends the bare
\{{AbstractPlatformException}}, which has no dedicated exception mapper, so it
falls through to \{{DefaultExceptionMapper}}, which always returns 500. This
affects every content policy that throws it:
* \{{WhitelistContentPolicy}} (file name / mime type not allowed)
* \{{MimeContentPolicy}} (declared vs. detected mime type mismatch)
* \{{TraversalContentPolicy}} (path traversal)
*Expected*
A 4xx response with a message saying why the file was rejected (e.g. 400 as a
validation error).
*Proposed fix*
Make \{{ContentPolicyException}} map to a 4xx response, and add
unit/integration tests covering a rejected upload.
I'd like to work on this.
> Document upload returns HTTP 500 when a content policy rejects the file
> (e.g. disallowed file type)
> ----------------------------------------------------------------------------------------------------
>
> Key: FINERACT-2935
> URL: https://issues.apache.org/jira/browse/FINERACT-2935
> Project: Apache Fineract
> Issue Type: Bug
> Components: System
> Affects Versions: 1.15.0
> Reporter: raashed
> Priority: Minor
>
> Uploading a document whose file type is not on the whitelist (e.g. a {{.txt}}
> file to \{{POST /v1/clients/<clientId>/documents}} is correctly rejected by
> {{{}WhitelistContentPolicy{}}}, but the API responds with *HTTP 500* instead
> of a client error.
> *Cause*
> {{ContentPolicyException}} (fineract-document,
> {{{}infrastructure.contentstore.exception{}}}) extends the bare
> {{{}AbstractPlatformException{}}}, which has no dedicated exception mapper,
> so it falls through to {{{}DefaultExceptionMapper{}}}, which always returns
> 500. This affects every content policy that throws it:
> * {{WhitelistContentPolicy}} (file name / mime type not allowed)
> * {{MimeContentPolicy}} (declared vs. detected mime type mismatch)
> * {{TraversalContentPolicy}} (path traversal)
> *Expected*
> A 4xx response with a message saying why the file was rejected (e.g. 400 as a
> validation error).
> *Proposed fix*
> Make {{ContentPolicyException}} map to a 4xx response, and add
> unit/integration tests covering a rejected upload.
> I'd like to work on this.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
