PathwayCommons / cpath2

Biological pathway data integration and access platform (Pathway Commons)
http://www.pathwaycommons.org/pc2/
MIT License
6 stars 5 forks source link

PC '/get?uri=...' can go crazy (instead of fail or return empty result) #289

Closed IgorRodchenkov closed 6 years ago

IgorRodchenkov commented 6 years ago

It turns out that one can submit a nonsense value for 'uri' parameter, by accident or intentionally, which might cause PC service trouble - trying to extract and convert a very large model!

For example: http://www.pathwaycommons.org/pc2/get?uri=htttp://identifiers.org/reactome/R-HSA-6803211&format=SBGN

Looks, the problem starts here, and we need to sanitize those "identifiers" (supposedly) - escape Lucene special symbols (not just one ':'), because otherwise PC internally creates an insane query like this, which surprisingly "works" (>660K hits)!