https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43196 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://github.com/perl4lib | |/marc-perl/issues/27 Status|NEW |ASSIGNED --- Comment #1 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- I filed an issue on `marc-perl` because the `MiJ` implementation accepts being passed `undef` (i.e. the result from `$c->req->json` on invalid JSON data. I will implement defensive code to avoid the issue. By design, `MARC::Record` will always return a `MARC::Record` object, so we need to check for empty fields also for `USMARC` and `MARCXML`. The latter explodes on bad XML, but the controller catches it and throws an `unhandled exception` with error 500. This needs to be addressed here too. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43196 --- Comment #2 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- Created attachment 203350 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203350&action=edit Bug 43196: Regression tests for PUT /biblios with malformed bodies MARC::Record::new_from_mij_structure silently returns an empty record when passed undef or an invalid structure. The PUT /biblios endpoint does not validate the parsed record before calling ModBiblio, resulting in a 200 response for clearly invalid input. This patch adds regression tests for all three supported content types: - application/marc-in-json: truncated JSON, invalid structure, empty fields - application/marcxml+xml: truncated XML, empty record - application/marc: garbage input All should return 400 but currently return 200. Note: MARC::Record::MiJ upstream should arguably croak on undef/invalid input rather than returning a blank record. Test plan: 1. Apply patch 2. Run: $ prove t/db_dependent/api/v1/biblios.t => FAIL: put() malformed body tests fail (200 instead of 400) 3. Sign off :-D Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43196 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew@bywatersolutions.com | |, nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43196 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #203350|0 |1 is obsolete| | Attachment #203351|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43196 --- Comment #5 from David Nind <david@davidnind.com> --- Created attachment 203355 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203355&action=edit Bug 43196: Reject malformed MARC records in PUT /biblios MARC::Record parsers silently return empty records on invalid input: - new_from_mij_structure(undef) returns a blank record (MiJ) - new_from_usmarc(garbage) returns a blank record with warnings - new_from_xml(valid-but-empty) returns a blank record The PUT /biblios endpoint passed these blank records to ModBiblio, which overwrote existing bibliographic data with an empty record (only system-generated 005 and 999 fields survive). Wrap each parser call in try/catch (for MARCXML which dies on malformed XML) and validate the resulting record has at least one field before proceeding. Return 400 if parsing fails or produces an empty record. Note: MARC::Record::MiJ upstream has been patched to croak on undef/invalid input (perl4lib/marc-perl#28), but Koha needs this defensive check regardless for USMARC and empty-but-valid cases. Test plan: 1. Apply the regression tests from the previous commit 2. Run: $ prove t/db_dependent/api/v1/biblios.t => FAIL: put() malformed body tests fail 3. Apply this patch 4. Repeat step 2 => SUCCESS: Tests pass! 5. Sign off :-D Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io> Signed-off-by: David Nind <david@davidnind.com> -- You are receiving this mail because: You are watching all bug changes.