search

Breeze / breeze.server.net

Breeze support for .NET servers
MIT License
76 stars 62 forks source link

$select backdoor to expand despite AllowedQueryOptions.Expand set to false #26

Closed eggers closed 2 years ago

eggers commented 9 years ago

I am finally getting around to using the EnableBreezeQuery as described in #12, but I'm having an issue.

I've set the options to disable expand, so as expected, if I call: orders?$expand=privateObject, I'll get the expected error:

{
  "$id":"1",
  "$type":"System.Web.Http.HttpError, System.Web.Http",
  "Message":"The query specified in the URI is not valid. Query option 'Expand' is not allowed. To allow it, set the 'AllowedQueryOptions' property on EnableQueryAttribute or QueryValidationSettings.",
  "ExceptionMessage":"Query option 'Expand' is not allowed. To allow it, set the 'AllowedQueryOptions' property on EnableQueryAttribute or QueryValidationSettings.",
  "ExceptionType":"Microsoft.Data.OData.ODataException",
  "StackTrace":"   at System.Web.Http.OData.Query.Validators.ODataQueryValidator.ValidateQueryOptionAllowed(AllowedQueryOptions queryOption, AllowedQueryOptions allowed)\r\n   at System.Web.Http.OData.Query.Validators.ODataQueryValidator.Validate(ODataQueryOptions options, ODataValidationSettings validationSettings)\r\n   at System.Web.Http.OData.EnableQueryAttribute.ValidateQuery(HttpRequestMessage request, ODataQueryOptions queryOptions)\r\n   at Breeze.WebApi2.EnableBreezeQueryAttribute.ValidateQuery(HttpRequestMessage request, ODataQueryOptions queryOptions)\r\n   at System.Web.Http.OData.EnableQueryAttribute.ExecuteQuery(Object response, HttpRequestMessage request, HttpActionDescriptor actionDescriptor)\r\n   at System.Web.Http.OData.EnableQueryAttribute.OnActionExecuted(HttpActionExecutedContext actionExecutedContext)"
}

However, if I just call: orders?$select=privateObject, the privateObject will be returned. It looks like you can by pass the expand restriction by just use $select

wardbell commented 9 years ago

Yup. You either have to disable select as well or examine the query string inside your method and detect unwanted syntax.

This is in the nature of LINQ. Breeze is not involved. The EnableBreezeQuery attribute mostly just delegates to the Web API EnableQuery.

I'm open to suggestions.