plone / plone.restapi

RESTful API for Plone.
http://plonerestapi.readthedocs.org/
84 stars 73 forks source link

`@querystring-search` endpoint doesn't validate input sufficiently #1652

Closed davisagli closed 1 year ago

davisagli commented 1 year ago

There are various ways to give @querystring-search invalid input that causes a 500 error. These should return a 400 Bad Request response instead, to avoid cluttering error logs.

Examples:

  1. https://demo.plone.org/++api++/@querystring-search?query={ (Raises DeserializationError)
  2. https://demo.plone.org/++api++/@querystring-search?query={"b_size":"1*100","query":[{"i":"portal_type","o":"plone.app.querystring.operation.selection.any","v":["News+Item"]}]} (raises ValueError)
  3. https://demo.plone.org/++api++/@querystring-search?query={"query":[{"i":"portal_type","o":"bogus","v":["News+Item"]}]} (raises KeyError)