magento / magento2

Prior to making any Submission(s), you must sign an Adobe Contributor License Agreement, available here at: https://opensource.adobe.com/cla.html. All Submissions you make to Adobe Inc. and its affiliates, assigns and subsidiaries (collectively “Adobe”) are subject to the terms of the Adobe Contributor License Agreement.
http://www.magento.com
Open Software License 3.0
11.55k stars 9.32k forks source link

Malformed request body or parameters cause "Internal Server Error" #32784

Open iasthc opened 3 years ago

iasthc commented 3 years ago

Preconditions (*)

  1. Magento CLI 2.4.2
  2. Magento/2.4 (Community)

Steps to reproduce (*)

  1. [GET] /V1/bulk

    • query: searchCriteria[sortOrders][0][field]=string
  2. [GET] /V1/carts/licence/list

    • query: searchCriteria[filterGroups][0][filters][0][value]=string
  3. [GET] /V1/carts/search

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  4. [GET] /V1/categories/attributes

    • query: searchCriteria[filterGroups][0][filters][0][conditionType]=string
  5. [GET] /V1/cmsBlock/search

    • query: searchCriteria[filterGroups][0][filters][0][conditionType]=string
  6. [GET] /V1/cmsPage/search

    • query: searchCriteria[sortOrders][0][field]=string
  7. [GET] /V1/coupons/search

    • query: searchCriteria[filterGroups][0][filters][0][value]=1
  8. [GET] /V1/creditmemos

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  9. [GET] /V1/customerGroups/search

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  10. [GET] /V1/eav/attribute-sets/list

    • query: searchCriteria[filterGroups][0][filters][0][value]=string
  11. [GET] /V1/inventory/are-product-salable-for-requested-qty/

    • query: skuRequests[0][qty]=1
  12. [GET] /V1/inventory/get-distance

    • query: source[lng]=1
  13. [GET] /V1/inventory/get-latlng-from-address

    • query: address[street]=string
  14. [GET] /V1/inventory/get-latslngs-from-address

    • query: address[country]=string
  15. [GET] /V1/inventory/in-store-pickup/pickup-locations/

    • query: searchRequest[area][radius]=0
  16. [GET] /V1/inventory/source-items

    • query: searchCriteria[sortOrders][0][field]=string
  17. [GET] /V1/inventory/sources

    • query: searchCriteria[filterGroups][0][filters][0][value]=
  18. [GET] /V1/inventory/stock-source-links

    • query: searchCriteria[filterGroups][0][filters][0][conditionType]=string
  19. [GET] /V1/inventory/stocks

    • query: searchCriteria[sortOrders][0][field]=string
  20. [GET] /V1/invoices

    • query: searchCriteria[filterGroups][0][filters][0][value]=string
  21. [GET] /V1/orders

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  22. [GET] /V1/orders/items

    • query: searchCriteria[sortOrders][0][field]=string
  23. [GET] /V1/products/attribute-sets/groups/list

    • query: searchCriteria[filterGroups][0][filters][0][value]=string
  24. [GET] /V1/products/attribute-sets/sets/list

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  25. [GET] /V1/products/attributes

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  26. [GET] /V1/salesRules/search

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  27. [GET] /V1/search

    • query: searchCriteria[requestName]=string
  28. [GET] /V1/shipments

    • query: searchCriteria[sortOrders][0][field]=string
  29. [GET] /V1/taxClasses/search

    • query: searchCriteria[filterGroups][0][filters][0][value]=string
  30. [GET] /V1/taxRates/search

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  31. [GET] /V1/taxRules/search

    • query: searchCriteria[filterGroups][0][filters][0][field]=string
  32. [GET] /V1/transactions

    • query: searchCriteria[filterGroups][0][filters][0][conditionType]=string
  33. [POST] /V1/address/cleanse

    • application/json: { "address": { "sub_division": null } }
  34. [POST] /V1/carts/mine/billing-address

    • application/json: { "address": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  35. [POST] /V1/carts/mine/estimate-shipping-methods

    • application/json: { "address": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  36. [POST] /V1/carts/mine/items

    • application/json: { "cartItem": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] }, "item_id": 0 } }
  37. [POST] /V1/carts/mine/payment-information

    • application/json: { "billingAddress": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  38. [POST] /V1/carts/mine/set-payment-information

    • application/json: { "billingAddress": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  39. [POST] /V1/carts/mine/shipping-information

    • application/json: { "addressInformation": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  40. [POST] /V1/carts/mine/totals-information

    • application/json: { "addressInformation": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  41. [POST] /V1/carts/{cartId}/estimate-shipping-methods

    • application/json: { "address": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  42. [POST] /V1/carts/{quoteId}/items

    • application/json: { "cartItem": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  43. [POST] /V1/categories

    • application/json: { "category": { "children": "string" } }
  44. [POST] /V1/coupons

    • application/json: { "coupon": { "extension_attributes": { "ddg_extension_attributes": { "email": "string" } } } }
  45. [POST] /V1/guest-address/cleanse

    • application/json: { "address": { "postal_code": null } }
  46. [POST] /V1/guest-carts/{cartId}/billing-address

    • application/json: { "address": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  47. [POST] /V1/guest-carts/{cartId}/estimate-shipping-methods

    • application/json: { "address": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  48. [POST] /V1/guest-carts/{cartId}/items

    • path: cartId=striring
    • application/json: { "cartItem": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  49. [POST] /V1/guest-carts/{cartId}/payment-information

    • application/json: { "billingAddress": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  50. [POST] /V1/guest-carts/{cartId}/set-payment-information

    • application/json: { "billingAddress": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  51. [POST] /V1/guest-carts/{cartId}/shipping-information

    • application/json: { "addressInformation": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  52. [POST] /V1/guest-carts/{cartId}/totals-information

    • application/json: { "addressInformation": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  53. [POST] /V1/inventory/source-selection-algorithm-result

    • application/json: { "algorithmCode": "string", "inventoryRequest": { "stock_id": 32 } }
  54. [POST] /V1/invoices/

    • application/json: { "entity": { "payment": { "method": "string" }, "updated_at": "string" } }
  55. [POST] /V1/orders

    • application/json: { "entity": { "payment": { "method": "string" }, "updated_at": "string" } }
  56. [POST] /V1/products

    • application/json: { "product": { "extension_attributes": { "stock_item": { "show_default_notification_message": true } } } }
  57. [POST] /V1/salesRules

    • application/json: { "rule": { "from_date": "string" } }
  58. [POST] /V1/vertex-address-validation/vertex-address

    • application/json: { "address": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  59. [PUT] /V1/amazon-billing-address/{amazonOrderReferenceId}

    • application/json: {"addressConsentToken":""}
  60. [PUT] /V1/amazon-shipping-address/{amazonOrderReferenceId}

    • application/json: {"addressConsentToken":""}
  61. [PUT] /V1/carts/mine/items/{itemId}

    • application/json: { "cartItem": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  62. [PUT] /V1/carts/{cartId}/items/{itemId}

    • application/json: { "cartItem": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  63. [PUT] /V1/categories/{id}

    • application/json: { "category": { "children": "string" } }
  64. [PUT] /V1/configurable-products/variation

    • application/json: { "product": { "extension_attributes": { "stock_item": { "show_default_notification_message": true } } } }
  65. [PUT] /V1/guest-carts/{cartId}/items/{itemId}

    • path: cartId=string
    • path: itemId=string
    • application/json: { "cartItem": { "extension_attributes": { "discounts": [ { "discount_data": { "amount": 0 } } ] } } }
  66. [PUT] /V1/orders/create

    • application/json: { "entity": { "payment": { "method": "string" }, "updated_at": "string" } }
  67. [PUT] /V1/products/{sku}

    • application/json: { "product": { "extension_attributes": { "stock_item": { "show_default_notification_message": true } } } }

Expected result (*)

All responses above should be "400 Bad Requests".

Actual result (*)

截圖 2021-04-19 下午7 57 50 截圖 2021-04-19 下午7 55 55 截圖 2021-04-19 下午7 52 27 截圖 2021-04-19 下午7 51 15 截圖 2021-04-19 下午7 18 56 截圖 2021-04-19 下午7 15 42 截圖 2021-04-19 下午7 15 02 截圖 2021-04-19 下午7 13 42 截圖 2021-04-19 下午7 13 08 截圖 2021-04-19 下午7 12 34 截圖 2021-04-19 下午7 12 00 截圖 2021-04-19 下午7 11 31 截圖 2021-04-19 下午7 11 01 截圖 2021-04-19 下午7 10 51 截圖 2021-04-19 下午7 10 13 截圖 2021-04-19 下午7 09 37 截圖 2021-04-19 下午7 08 26 截圖 2021-04-19 下午7 04 12 截圖 2021-04-19 下午7 00 11 截圖 2021-04-19 下午6 58 58 截圖 2021-04-19 下午6 57 10 截圖 2021-04-19 下午6 56 55 截圖 2021-04-19 下午6 56 37 截圖 2021-04-19 下午6 56 03 截圖 2021-04-19 下午6 53 41 截圖 2021-04-19 下午6 52 33 截圖 2021-04-19 下午6 51 51 截圖 2021-04-19 下午6 50 19 截圖 2021-04-19 下午6 49 50 截圖 2021-04-19 下午6 49 23 截圖 2021-04-19 下午6 48 37 截圖 2021-04-19 下午6 47 59 截圖 2021-04-19 下午6 47 35 截圖 2021-04-19 下午6 47 06 截圖 2021-04-19 下午6 44 18 截圖 2021-04-19 下午6 43 35 截圖 2021-04-19 下午6 41 56 截圖 2021-04-19 下午6 39 48 截圖 2021-04-19 下午6 39 17 截圖 2021-04-19 下午6 38 52 截圖 2021-04-19 下午5 34 54 截圖 2021-04-19 下午5 34 33 截圖 2021-04-19 下午5 34 10 截圖 2021-04-19 下午5 33 47 截圖 2021-04-19 下午5 33 14 截圖 2021-04-19 下午5 32 26 截圖 2021-04-19 下午5 31 59 截圖 2021-04-19 下午5 30 40 截圖 2021-04-19 下午5 30 20 截圖 2021-04-19 下午5 30 06 截圖 2021-04-19 下午5 29 28 截圖 2021-04-19 下午5 29 08 截圖 2021-04-19 下午5 28 30 截圖 2021-04-19 下午5 28 03 截圖 2021-04-19 下午5 27 39 截圖 2021-04-19 下午5 27 12 截圖 2021-04-19 下午5 25 47 截圖 2021-04-19 下午5 24 07 截圖 2021-04-19 下午5 23 47 截圖 2021-04-19 下午5 22 51 截圖 2021-04-19 下午5 22 21 截圖 2021-04-19 下午5 21 32 截圖 2021-04-19 下午5 20 44 截圖 2021-04-19 下午5 20 12 截圖 2021-04-19 下午5 19 52 截圖 2021-04-19 下午5 18 54


Please provide Severity assessment for the Issue as Reporter. This information will help during Confirmation and Issue triage processes.

m2-assistant[bot] commented 3 years ago

Hi @iasthc. Thank you for your report. To help us process this issue please make sure that you provided the following information:

Please make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce. To deploy vanilla Magento instance on our environment, please, add a comment to the issue:

@magento give me 2.4-develop instance - upcoming 2.4.x release

For more details, please, review the Magento Contributor Assistant documentation.

Please, add a comment to assign the issue: @magento I am working on this


:clock10: You can find the schedule on the Magento Community Calendar page.

:telephone_receiver: The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, please join the Community Contributions Triage session to discuss the appropriate ticket.

:movie_camera: You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel

:pencil2: Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel

magento-engcom-team commented 3 years ago

:white_check_mark: Confirmed by @engcom-Oscar Thank you for verifying the issue. Based on the provided information internal tickets MC-42007 were created

Issue Available: @engcom-Oscar, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself.

artskirk commented 2 years ago

@magento I am working on this

engcom-Delta commented 2 months ago

Hi @iasthc ,

Thanks for your reporting and collaboration. We have verified the issue in latest 2.4-develop instance and the issue is reproducible. Kindly refer the screenshots.

Steps to reproduce Run Below API's

  1. [GET] /V1/bulk query: searchCriteria[sortOrders][0][field]=string image
  2. [GET] /V1/carts/licence/list query: searchCriteria[filterGroups][0][filters][0][value]=string image
  3. [GET] /V1/carts/search query: searchCriteria[filterGroups][0][filters][0][field]=string image
  4. [GET] /V1/categories/attributes query: searchCriteria[filterGroups][0][filters][0][conditionType]=string image
  5. [GET] /V1/cmsBlock/search query: searchCriteria[filterGroups][0][filters][0][conditionType]=string image
  6. [GET] /V1/cmsPage/search query: searchCriteria[sortOrders][0][field]=string image
  7. [GET] /V1/coupons/search query: searchCriteria[filterGroups][0][filters][0][value]=1 image
  8. [GET] /V1/creditmemos query: searchCriteria[filterGroups][0][filters][0][field]=string image
  9. [GET] /V1/customerGroups/search query: searchCriteria[filterGroups][0][filters][0][field]=string image
  10. [GET] /V1/eav/attribute-sets/list query: searchCriteria[filterGroups][0][filters][0][value]=string image
  11. [GET] /V1/inventory/are-product-salable-for-requested-qty/ query: skuRequests[0][qty]=1 image
  12. [GET] /V1/inventory/get-distance query: source[lng]=1 image
  13. [GET] /V1/inventory/get-latlng-from-address query: address[street]=string image
  14. [GET] /V1/inventory/get-latslngs-from-address query: address[country]=string image
  15. [GET] /V1/inventory/in-store-pickup/pickup-locations/ query: searchRequest[area][radius]=0 image
  16. [GET] /V1/inventory/source-items query: searchCriteria[sortOrders][0][field]=string image
  17. [GET] /V1/inventory/sources query: searchCriteria[filterGroups][0][filters][0][value]= image
  18. [GET] /V1/inventory/stock-source-links query: searchCriteria[filterGroups][0][filters][0][conditionType]=string image
  19. [GET] /V1/inventory/stocks query: searchCriteria[sortOrders][0][field]=string image
  20. [GET] /V1/invoices query: searchCriteria[filterGroups][0][filters][0][value]=string image
  21. [GET] /V1/orders query: searchCriteria[filterGroups][0][filters][0][field]=string image
  22. [GET] /V1/orders/items query: searchCriteria[sortOrders][0][field]=string image
  23. [GET] /V1/products/attribute-sets/groups/list query: searchCriteria[filterGroups][0][filters][0][value]=string image
  24. [GET] /V1/products/attribute-sets/sets/list query: searchCriteria[filterGroups][0][filters][0][field]=string image
  25. [GET] /V1/products/attributes query: searchCriteria[filterGroups][0][filters][0][field]=string image
  26. [GET] /V1/salesRules/search query: searchCriteria[filterGroups][0][filters][0][field]=string image
  27. [GET] /V1/search query: searchCriteria[requestName]=string image
  28. [GET] /V1/shipments query: searchCriteria[sortOrders][0][field]=string image
  29. [GET] /V1/taxClasses/search query: searchCriteria[filterGroups][0][filters][0][value]=string image
  30. [GET] /V1/taxRates/search query: searchCriteria[filterGroups][0][filters][0][field]=string image
  31. [GET] /V1/taxRules/search query: searchCriteria[filterGroups][0][filters][0][field]=string image
  32. [GET] /V1/transactions query: searchCriteria[filterGroups][0][filters][0][conditionType]=string image
  33. [POST] /V1/address/cleanse application/json: { "address": { "sub_division": null } }

Thanks.

github-jira-sync-bot commented 2 months ago

:x: Cannot export the issue. This GitHub issue is already linked to Jira issue(s): https://jira.corp.adobe.com/browse/AC-746