-
Notifications
You must be signed in to change notification settings - Fork 10
Open
Description
Date, Datetime, and Time validation is lacking. https://github.com/procore/brita/blob/master/lib/brita/type_validator.rb#L4
It currently matches a very generic range pattern that may lead to a database error when trying to parse an input value.
Here is an example:
datetime = DateTime.new(2016,12,24).to_s
=> "2016-12-24T00:00:00+00:00"
Constructing a query in postman with this value causes an error:
?filters[updated_at]=2016-12-24T00:00:00+00:00...2016-12-29T12:16:44+00:00
On the server this gets parsed into:
"filters"=>{"updated_at"=>"2016-12-24T00:00:00 00:00...2016-12-29T12:16:44 00:00"}
- Note that
+gets replaced with a blank space character.
This passes the range pattern but fails at the database leading to a 500 error.
Metadata
Metadata
Assignees
Labels
No labels