Repository navigation
GET request to /sharing (with no parameters) crashes the server #1764
Description
Tested on 5.7.8 and On 5.7.9-beta running in a docker container.
Fetching the URL https://localhost:8443/sharing (with no parameters) causes the server to crash with the following output on the console:
solid | TypeError: Invalid URL
solid | at new URL (node:internal/url:775:36)
solid | at SharingRequest.getAppUrl (/usr/src/app/lib/requests/sharing-request.js:156:12)
solid | at get (/usr/src/app/lib/requests/sharing-request.js:70:28)
solid | at Layer.handle [as handle_request] (/usr/src/app/node_modules/express/lib/router/layer.js:95:5)
solid | at next (/usr/src/app/node_modules/express/lib/router/route.js:144:13)
solid | at Route.dispatch (/usr/src/app/node_modules/express/lib/router/route.js:114:3)
solid | at Layer.handle [as handle_request] (/usr/src/app/node_modules/express/lib/router/layer.js:95:5)
solid | at /usr/src/app/node_modules/express/lib/router/index.js:284:15
solid | at Function.process_params (/usr/src/app/node_modules/express/lib/router/index.js:346:12)
solid | at next (/usr/src/app/node_modules/express/lib/router/index.js:280:10) {
solid | code: 'ERR_INVALID_URL',
solid | input: 'undefined'
solid | }
It looks like the sharing-request handler is missing input validation to make sure all the expected parameters are present.
Activity
bourgeoa commentedon Mar 8, 2024
Thanks. Yes you are right
bourgeoa commentedon Mar 8, 2024
@ylebre
Could you check the PR #1765
I tested locally with
/sharing,sharing?and/sharing?test=anything.ylebre commentedon Mar 12, 2024
That fixes it for the GET request.
It seems the same issue is also in POST requests, sending it with empty GET variables also stops the server.
bourgeoa commentedon Mar 12, 2024
What do you mean by
empty GET variablesylebre commentedon Mar 13, 2024
A POST request to the server with an empty body also seems to trigger the same issue. I was confused about where the post request was getting the variables from, sorry about that.