[Bug 35129] New: REST API: _per_page=0 crashes on Illegal division by zero
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Bug ID: 35129 Summary: REST API: _per_page=0 crashes on Illegal division by zero Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: REST API Assignee: koha-bugs@lists.koha-community.org Reporter: m.de.rooy@rijksmuseum.nl CC: tomascohen@gmail.com
From IRC:
[14:08] <marcelr> Nice /api/v1/patrons?_page=1&_per_page=0 just returns me a 500 (ISE) [14:09] <marcelr> not tested yet :) [14:10] <marcelr> [ERROR] GET /api/v1/patrons: unhandled exception (Mojo::Exception)<<Illegal division by zero at /usr/share/koha/Koha/REST/Plugin/Pagination.pm line 106.>> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 --- Comment #1 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- To prohibit _per_page=0 we could use OpenAPI 3.0 with not: const: 0 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 --- Comment #2 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Sorry no quick simple solution found yet. Take a try! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |tomascohen@gmail.com |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 --- Comment #3 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Nice catch. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 --- Comment #4 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 163342 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163342&action=edit Bug 35129: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 163343 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163343&action=edit Bug 35129: Return 400 if _per_page=0 passed This patch adds a safe guard for when consumers pass _per_page=0 to endpoints. This condition is checked for on a centralized place and avoid reaching the controller in such scenarios that would provoke a division by zero exception. To test: 1. Apply the regression tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/pagination.t => FAIL: We expect a 400, but get a 500 instead 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! No more explosions for this! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163342|0 |1 is obsolete| | --- Comment #6 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 163637 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163637&action=edit Bug 35129: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163343|0 |1 is obsolete| | --- Comment #7 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- Created attachment 163638 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=163638&action=edit Bug 35129: Return 400 if _per_page=0 passed This patch adds a safe guard for when consumers pass _per_page=0 to endpoints. This condition is checked for on a centralized place and avoid reaching the controller in such scenarios that would provoke a division by zero exception. To test: 1. Apply the regression tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/pagination.t => FAIL: We expect a 400, but get a 500 instead 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! No more explosions for this! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #163637|0 |1 is obsolete| | Attachment #163638|0 |1 is obsolete| | --- Comment #8 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 164222 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164222&action=edit Bug 35129: Regression tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 --- Comment #9 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 164223 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=164223&action=edit Bug 35129: Return 400 if _per_page=0 passed This patch adds a safe guard for when consumers pass _per_page=0 to endpoints. This condition is checked for on a centralized place and avoid reaching the controller in such scenarios that would provoke a division by zero exception. To test: 1. Apply the regression tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/pagination.t => FAIL: We expect a 400, but get a 500 instead 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! No more explosions for this! 5. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Laura Escamilla <laura.escamilla@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |24.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Pushed for 24.05! Well done everyone, thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Version(s)|24.05.00 |24.05.00,23.11.06 released in| | Status|Pushed to main |Pushed to stable --- Comment #11 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 23.11.x for 23.11.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|24.05.00,23.11.06 |24.05.00,23.11.06,23.05.12 released in| | CC| |lucas@bywatersolutions.com Status|Pushed to stable |Pushed to oldstable --- Comment #12 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 23.05.x for upcoming 23.05.12 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35129 Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldstable |RESOLVED CC| |wainuiwitikapark@catalyst.n | |et.nz --- Comment #13 from Wainui Witika-Park <wainuiwitikapark@catalyst.net.nz> --- Not backporting to 22.11 unless requested -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org