Skip to content

fix: return 400 when text_search is called without a text parameter - #802

Open
xovishnukosuri wants to merge 1 commit into
OWASP:mainfrom
xovishnukosuri:fix/text-search-missing-param
Open

xovishnukosuri wants to merge 1 commit into
OWASP:mainfrom
xovishnukosuri:fix/text-search-missing-param

Conversation

@xovishnukosuri

Copy link
Copy Markdown

Problem

GET /rest/v1/text_search without the text query parameter passes None
to db.text_search(). Inside that function, re.search(pattern, None, ...)
raises TypeError, which Flask surfaces as a 500 Internal Server Error instead
of a client-side 400.

Reproduce:

curl -i http://localhost:5000/rest/v1/text_search
# returns 500

Fix

Added a guard immediately after reading the text parameter in
application/web/web_main.py. If text is absent or empty, the endpoint
now aborts with 400 before touching the database.

Test

Added test_text_search_missing_param in application/tests/web_main_test.py
covering:

  • request with no text parameter → 400
  • request with text= (empty string) → 400

Calling /rest/v1/text_search without the text query parameter passed None
to db.text_search(), which then called re.search() with None and raised a
TypeError, resulting in a 500 instead of a descriptive 400.

Added a guard in the endpoint and a regression test covering both the
missing-parameter and empty-string cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant