fix: return 400 Bad Request on invalid ID in /v1/resource/view

server/api_handlers/resource_api_handlers.go

@@ -127,7 +127,15 @@ func GetResourceContentHandler(ctx contracts.ResourceReader) func(writer http.Re
 		var detailsQuery query_models.ResourceSearchQuery
 		var resource *models.Resource
 
-		if err := tryFillStructValuesFromRequest(&query, request); err != nil || query.ID == 0 {
+		if err := tryFillStructValuesFromRequest(&query, request); err != nil {
+			// If an ID was explicitly provided but failed to parse, it's a Bad Request.
+			if request.URL.Query().Has("id") || formHasField(request, "id") {
+				http_utils.HandleError(fmt.Errorf("invalid value for \"id\": must be a valid number"), writer, request, http.StatusBadRequest)
+				return
+			}
+		}
+
+		if query.ID == 0 {
 			if err := tryFillStructValuesFromRequest(&detailsQuery, request); err != nil {
 				http_utils.HandleError(err, writer, request, http.StatusBadRequest)
 				return
@@ -147,6 +155,7 @@ func GetResourceContentHandler(ctx contracts.ResourceReader) func(writer http.Re
 
 			resource = &resources[0]
 		} else {
+			var err error
 			resource, err = ctx.GetResource(query.ID)
 
 			if err != nil {

server/api_tests/resource_view_leak_test.go

@@ -39,3 +39,15 @@ func TestResourceView_InvalidId_NoSearchCriteria_Returns400(t *testing.T) {
 	assert.Equal(t, http.StatusBadRequest, resp.Code,
 		"GET /v1/resource/view with invalid id and no search criteria should return 400")
 }
+
+func TestResourceView_InvalidId_WithSearchCriteria_Returns400(t *testing.T) {
+	tc := SetupTestEnv(t)
+
+	res := &models.Resource{Name: "Another Secret", Meta: []byte(`{}`)}
+	tc.DB.Create(res)
+
+	resp := tc.MakeRequest(http.MethodGet, "/v1/resource/view?id=abc&name=Another", nil)
+
+	assert.Equal(t, http.StatusBadRequest, resp.Code,
+		"GET /v1/resource/view with invalid id and search criteria should return 400")
+}