When a user makes a request with mismatched square brackets, Goa panics due to out-of-range slice bounds.
Reproduction
Given the following:
var DynamicValueFilter = MapOf(String, MapOf(String, ArrayOf(String,
func() { Example("value") }),
func() { Example(map[string][]string{"field": {"value"}}) }),
func() { Example(map[string]map[string][]string{"parent": {"child": {"value"}}}) })
Payload(func() {
Attribute("custom_field", DynamicValueFilter, "Filter on an incident custom field. Custom field ID should be sent, followed by the operator and values. Accepted operator will depend on the custom field type.", func() {
Example(map[string]map[string][]string{"01GBSQF3FHF7FWZQNWGHAVQ804": {"one_of": {"01GBSQF3FHF7FWZQNWGHAVQ804", "01ET65M7ZARSFZ6TFDFVQDN9AA"}}})
})
})
Below is an example of a failing request:
GET /example?custom_field[0000004JFGGSTWX5A814HVMH4Y[one_of]=test
_(note how there is no closing ] before [one_of])_
If user passes an unmatched set of square brackets, as above, Goa will panic due to
Description
When a user makes a request with mismatched square brackets, Goa panics due to out-of-range slice bounds.
Reproduction
Given the following:
Below is an example of a failing request:
_(note how there is no closing
]
before[one_of]
)_If user passes an unmatched set of square brackets, as above, Goa will panic due to
I believe this is due to the following code not handling the case of unmatched brackets: https://github.com/goadesign/goa/blob/cdc84cd229ccf936f91ca725bf5f5e1a7ee0193e/http/codegen/templates/partial/query_map_conversion.go.tpl#L7