fix(rest): validate department log date as yyyy-MM-dd before Thrift call#4041
Open
Shivamrut wants to merge 1 commit intoeclipse-sw360:mainfrom
Open
fix(rest): validate department log date as yyyy-MM-dd before Thrift call#4041Shivamrut wants to merge 1 commit intoeclipse-sw360:mainfrom
Shivamrut wants to merge 1 commit intoeclipse-sw360:mainfrom
Conversation
Signed-off-by: Shivamrut <gshivamrut@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR fixes date validation for GET department log file content by date (
GET …/departments/logFileContent?date=…), implemented inSw360DepartmentService.getLogFileContentByDate.Background
The REST layer is supposed to ensure the
datequery parameter is a strict calendar date inyyyy-MM-dd(e.g.2025-04-04) before callingUserService.getLogFileContentByName, so malformed or unexpected strings are not passed through to the user/thrift layer. On failure, callers should receive a clearSW360Exceptionwith: Invalid date time format, must be: yyyy-MM-dd.What was wrong (root cause)
1) Wrong
CommonUtilspredicate inisValidDateCommonUtils.isNotNullEmptyOrWhitespace(dateStr)in the first branch and returnedfalseimmediately when it was true.isNotNullEmptyOrWhitespaceis true when the string has non-blank content (i.e. it is not null/empty/whitespace-only).2025-04-04and garbage likebad-date), that branch ran and the method returnedfalsewithout ever callingLocalDate.parse.LocalDate.parse(..., yyyy-MM-dd)path was therefore unreachable for typical non-empty parameters, soyyyy-MM-ddwas never enforced in practice.2) Caller condition did not match a sensible “valid date” meaning
getLogFileContentByDateusedif (isValidDate(date)) { throw … invalid format }while the private helper was namedisValidDate.isValidDatemeans “parses asyyyy-MM-dd” (returnstrueonly then). The caller must reject when validation fails, i.e.if (!isValidDate(date)) { throw … }.Together, these bugs meant invalid strings could still be forwarded to
getLogFileContentByName, while the intended early validation path did not work reliably.What this PR changes
isValidDate(String dateStr)falseif the value is null, empty, or only whitespace (CommonUtils.isNullEmptyOrWhitespace).DateTimeFormatterpatternyyyy-MM-ddandLocalDate.parse.trueonly if parsing succeeds;DateTimeParseException→false.getLogFileContentByDate(String date)if (!isValidDate(date))→ throwSW360Exceptionwith Invalid date time format, must be: yyyy-MM-dd.userClient.getLogFileContentByName(date)(unchanged thrift contract for valid input).No new dependencies.
Regression and compatibility
DepartmentControllerpasses thedaterequest parameter straight into the service. No controller change required. Clients that already sendyyyy-MM-dd(e.g.?date=2025-04-04) see the same successful path: same string reachesgetLogFileContentByNameas before.UserHandler.getLogFileContentByNamestill receives ayyyy-MM-dd-compatible name when the request succeeds. Behavior change is limited to invalid inputs: they are now rejected in the service with the documented exception instead of being passed through.LocalDate.parseaccepts foryyyy-MM-ddsucceed (e.g. no extra suffix, no alternate separators). This matches the documented format.How to test (reviewer)
GET …/api/departments/logFileContent?date=2025-04-04(with auth as required) → 200 and log lines when configured (same as before for valid dates).?date=bad-dateor?date=2025-13-40→SW360Exceptionpath (HTTP status depends on global exception handling; the service error message is fixed).date(if reachable) → validation failure.Suggest Reviewer
@GMishx @rudra-superrr @bibhuti230185 @KoukiHama