Skip to content

api: Warn if query parameters have multiple values #5009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nvazquez merged 4 commits into from
Mar 8, 2022
Merged

api: Warn if query parameters have multiple values #5009

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4d4d8d5
api: Ensure single query parameter value
davidjumani May 10, 2021
05d2491
Merge branch 'main' of github.com:apache/cloudstack into fix-query-param
davidjumani Feb 25, 2022
a314adc
change error to warn
davidjumani Mar 4, 2022
cf2c1c4
Address comments
davidjumani Mar 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion server/src/main/java/com/cloud/api/ApiServer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,7 +464,11 @@ public void handle(final HttpRequest request, final HttpResponse response, final
responseType = param.getValue();
continue;
}
parameterMap.put(param.getName(), new String[]{param.getValue()});
if(parameterMap.putIfAbsent(param.getName(), new String[]{param.getValue()}) != null) {
String message = String.format("Query parameter '%s' has multiple values [%s, %s]. Only the last value will be respected." +
"It is advised to pass only a single parameter", param.getName(), param.getValue(), parameterMap.get(param.getName()));
s_logger.warn(message);
Comment on lines +468 to +470
Copy link
Copy Markdown
Contributor

@DaanHoogland DaanHoogland Mar 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a joint ApiServer/ApiServlet Utility to put this warning message in, instead of copying the exact same text?
Alternatively can we change the text to indicate where/why we object to the duplicate parameter?

}
}
}

Expand Down
15 changes: 14 additions & 1 deletion server/src/main/java/com/cloud/api/ApiServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,17 @@ public void run() {
});
}

private void checkSingleQueryParameterValue(Map<String, String[]> params) {
params.forEach((k, v) -> {
if (v.length > 1) {
String message = String.format("Query parameter '%s' has multiple values %s. Only the last value will be respected." +
"It is advised to pass only a single parameter", k, Arrays.toString(v));
s_logger.warn(message);
Comment thread
davidjumani marked this conversation as resolved.
}
});

}

void processRequestInContext(final HttpServletRequest req, final HttpServletResponse resp) {
InetAddress remoteAddress = null;
try {
Expand All @@ -156,7 +167,9 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
// get the response format since we'll need it in a couple of places
String responseType = HttpUtils.RESPONSE_TYPE_XML;
final Map<String, Object[]> params = new HashMap<String, Object[]>();
params.putAll(req.getParameterMap());
Map<String, String[]> reqParams = req.getParameterMap();
checkSingleQueryParameterValue(reqParams);
params.putAll(reqParams);

// For HTTP GET requests, it seems that HttpServletRequest.getParameterMap() actually tries
// to unwrap URL encoded content from ISO-9959-1.
Expand Down