diff --git a/server/api_handlers/resource_api_handlers.go b/server/api_handlers/resource_api_handlers.go index 8e5784f69..5c3d0a65e 100644 --- a/server/api_handlers/resource_api_handlers.go +++ b/server/api_handlers/resource_api_handlers.go @@ -127,7 +127,15 @@ func GetResourceContentHandler(ctx contracts.ResourceReader) func(writer http.Re var detailsQuery query_models.ResourceSearchQuery var resource *models.Resource - if err := tryFillStructValuesFromRequest(&query, request); err != nil || query.ID == 0 { + if err := tryFillStructValuesFromRequest(&query, request); err != nil { + // If an ID was explicitly provided but failed to parse, it's a Bad Request. + if request.URL.Query().Has("id") || formHasField(request, "id") { + http_utils.HandleError(fmt.Errorf("invalid value for \"id\": must be a valid number"), writer, request, http.StatusBadRequest) + return + } + } + + if query.ID == 0 { if err := tryFillStructValuesFromRequest(&detailsQuery, request); err != nil { http_utils.HandleError(err, writer, request, http.StatusBadRequest) return @@ -147,6 +155,7 @@ func GetResourceContentHandler(ctx contracts.ResourceReader) func(writer http.Re resource = &resources[0] } else { + var err error resource, err = ctx.GetResource(query.ID) if err != nil { diff --git a/server/api_tests/resource_view_leak_test.go b/server/api_tests/resource_view_leak_test.go index c0b4c7a84..8e9ebdffa 100644 --- a/server/api_tests/resource_view_leak_test.go +++ b/server/api_tests/resource_view_leak_test.go @@ -39,3 +39,15 @@ func TestResourceView_InvalidId_NoSearchCriteria_Returns400(t *testing.T) { assert.Equal(t, http.StatusBadRequest, resp.Code, "GET /v1/resource/view with invalid id and no search criteria should return 400") } + +func TestResourceView_InvalidId_WithSearchCriteria_Returns400(t *testing.T) { + tc := SetupTestEnv(t) + + res := &models.Resource{Name: "Another Secret", Meta: []byte(`{}`)} + tc.DB.Create(res) + + resp := tc.MakeRequest(http.MethodGet, "/v1/resource/view?id=abc&name=Another", nil) + + assert.Equal(t, http.StatusBadRequest, resp.Code, + "GET /v1/resource/view with invalid id and search criteria should return 400") +}