gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 37018: Handle exception in unhandled_exception() helper 

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
Tomas Cohen Arazi 2024-07-08 16:48:01 -03:00 committed by Lucas Gass
parent 803a554717
commit 21fd44f505
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Koha/REST/Plugin/Exceptions.pm
View File

@ -59,6 +59,16 @@ sub register {
my $path = $req->url->to_abs->path;
my $type = "";
if ( blessed $exception && ref($exception) eq 'Koha::Exceptions::REST::Query::InvalidOperator' ) {
return $c->render(
status => 500,
json => {
error => printf( "Invalid operator in query: %s", $exception->operator ),
error_code => 'invalid_query',
}
);
}
if ( blessed $exception ) {
$type = "(" . ref($exception) . ")";
}

2
t/db_dependent/api/v1/query.t
View File

@ -171,7 +171,7 @@ subtest 'SQL injection in "query" handling' => sub {
"[{\"-and\":[[{\"me.patron_id\":{\"like(IF(ASCII(SUBSTRING((SELECT version()),1,1))=ASCII('1'),SLEEP(1/100000),0))or\":\"\%a\%\"}}]]}]";
$t->get_ok("//$userid:$password@/api/v1/patrons?q=$q")
->status_is( 400, 'Attempt to inject SQL through operators is rejected' );
->status_is( 500, 'Attempt to inject SQL through operators is rejected' );
$schema->storage->txn_rollback;
};