Add validation for search parameter URL length (#5454)

* Add validation for search parameter URL length exceeding maximum limit

Author: jestradaMS

src/Microsoft.Health.Fhir.Core/Resources.Designer.cs

@@ -870,4 +870,7 @@
   <data name="ReindexingNoSearchParameterstoReindex" xml:space="preserve">
     <value>There are no search parameters to reindex for job Id: {0}.</value>
   </data>
+  <data name="SearchParameterDefinitionInvalidUriExceedsMaxLength" xml:space="preserve">
+    <value>Search Parameter URL {0} exceeds the maximum length limit of {1}</value>
+  </data>
 </root>

src/Microsoft.Health.Fhir.Core/Resources.resx

@@ -41,6 +41,7 @@ public class SearchParameterValidator : ISearchParameterValidator
         private readonly ISearchParameterOperations _searchParameterOperations;
         private readonly ISearchParameterComparer<SearchParameterInfo> _searchParameterComparer;
         private readonly ILogger _logger;
+        private readonly int _maxUrlLength = 128;
 
         private const string HttpPostName = "POST";
         private const string HttpPutName = "PUT";
@@ -103,6 +104,12 @@ public async Task ValidateSearchParameterInput(SearchParameter searchParam, stri
                 validationFailures.Add(
                     new ValidationFailure(nameof(Base.TypeName), Resources.SearchParameterDefinitionInvalidMissingUri));
             }
+            else if (searchParam.Url.Length > _maxUrlLength)
+            {
+                _logger.LogInformation("Search parameter definition has a url that exceeds the maximum length. url: {Url}, length: {Length}", searchParam.Url, searchParam.Url.Length);
+                validationFailures.Add(
+                    new ValidationFailure(nameof(searchParam.Url), string.Format(Resources.SearchParameterDefinitionInvalidUriExceedsMaxLength, searchParam.Url, _maxUrlLength)));
+            }
             else
             {
                 // Checks if the url is a valid url

src/Microsoft.Health.Fhir.Shared.Core/Features/Search/Parameters/SearchParameterValidator.cs

@@ -9,7 +9,6 @@
 using System.Net;
 using System.Threading.Tasks;
 using Hl7.Fhir.Model;
-using Hl7.Fhir.Serialization;
 using Microsoft.Health.Core.Extensions;
 using Microsoft.Health.Extensions.Xunit;
 using Microsoft.Health.Fhir.Client;
@@ -34,7 +33,9 @@ public class CustomSearchParamTests : SearchTestsBase<HttpIntegrationTestFixture
     {
         private readonly HttpIntegrationTestFixture _fixture;
         private readonly ITestOutputHelper _output;
+        private const int MaxAllowedUrlLength = 128;
         private const int MaxRetryCount = 10;
+        private const string UrlLengthValidationMessage = "exceeds the maximum length limit of 128";
 
         public CustomSearchParamTests(HttpIntegrationTestFixture fixture, ITestOutputHelper output)
             : base(fixture)
@@ -69,5 +70,61 @@ public async Task GivenAnInvalidSearchParam_WhenCreatingParam_ThenMeaningfulErro
                 Assert.Contains(ex.OperationOutcome.Issue, i => i.Diagnostics.Contains(errorMessage));
             }
         }
+
+        [Fact]
+        public async Task GivenASearchParameterWithUrlLongerThan128_WhenCreating_ThenValidationErrorReturned()
+        {
+            SearchParameter searchParam = CreateCustomSearchParameter(MaxAllowedUrlLength + 1);
+
+            using FhirClientException exception = await Assert.ThrowsAsync<FhirClientException>(() => Client.CreateAsync(searchParam));
+
+            Assert.Contains(exception.OperationOutcome.Issue, issue => issue.Diagnostics.Contains(UrlLengthValidationMessage));
+        }
+
+        [Fact]
+        public async Task GivenAnExistingSearchParameter_WhenUpdatingWithUrlLongerThan128_ThenValidationErrorReturned()
+        {
+            SearchParameter searchParam = CreateCustomSearchParameter();
+
+            using FhirResponse<SearchParameter> createResponse = await Client.UpdateAsync(searchParam);
+            Assert.Equal(HttpStatusCode.Created, createResponse.StatusCode);
+
+            searchParam.Url = CreateCustomSearchParameter(MaxAllowedUrlLength + 1).Url;
+
+            using FhirClientException exception = await Assert.ThrowsAsync<FhirClientException>(() => Client.UpdateAsync(searchParam));
+
+            Assert.Contains(exception.OperationOutcome.Issue, issue => issue.Diagnostics.Contains(UrlLengthValidationMessage));
+        }
+
+        private static SearchParameter CreateCustomSearchParameter(int urlLength = MaxAllowedUrlLength)
+        {
+            string suffix = Guid.NewGuid().ToString("N");
+            const string prefix = "http://example.org/fhir/SearchParameter/";
+
+#if R5
+            var baseResourceTypes = new List<VersionIndependentResourceTypesAll?>
+            {
+                VersionIndependentResourceTypesAll.Patient,
+            };
+#else
+            var baseResourceTypes = new List<ResourceType?>
+            {
+                ResourceType.Patient,
+            };
+#endif
+
+            return new SearchParameter
+            {
+                Id = $"custom-search-param-{suffix[..8]}",
+                Url = prefix + new string('a', urlLength - prefix.Length),
+                Name = $"CustomSearchParam{suffix[..8]}",
+                Status = PublicationStatus.Draft,
+                Description = new Markdown("Custom search parameter used for E2E URL validation tests."),
+                Code = $"customparam{suffix[..8]}",
+                Base = baseResourceTypes,
+                Type = SearchParamType.String,
+                Expression = "Patient.name",
+            };
+        }
     }
 }