[jira] [Resolved] (FINERACT-2761) Validate orderBy query parameters for Center listing

["Terence Monteiro (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/FINERACT-2761?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Terence Monteiro resolved FINERACT-2761.
----------------------------------------
    Resolution: Fixed

> Validate orderBy query parameters for Center listing
> ----------------------------------------------------
>
>                 Key: FINERACT-2761
>                 URL: https://issues.apache.org/jira/browse/FINERACT-2761
>             Project: Apache Fineract
>          Issue Type: Bug
>            Reporter: Terence Monteiro
>            Assignee: Terence Monteiro
>            Priority: Major
>             Fix For: 1.16.0
>
>
> {{CenterReadPlatformServiceImpl}} builds SQL for the plain and paginated Center listing endpoints ({{{}GET /centers{}}}) by concatenating caller-supplied {{{}orderBy{}}}/{{{}sortOrder{}}} values before validating them, rather than validating each parameter independently before use. Same pattern already fixed for runreports and offices.
> *Fix:*
>  * Validate {{orderBy}} via allow-list check before it's appended to the query.
>  * Restrict {{sortOrder}} to a strict {{{}ASC{}}}/{{{}DESC{}}} allow-list.
>  * Applied to both the plain and paginated listing methods.
> *Testing:* Regression tests added in {{CenterIntegrationTest}} for both endpoints — malicious {{orderBy}} and invalid {{sortOrder}} values now expect {{{}400{}}}.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)