[jira] [Updated] (FINERACT-2735) Validate order query parameter on datatables endpoint against actual table columns

["Terence Monteiro (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/FINERACT-2735?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Terence Monteiro updated FINERACT-2735:
---------------------------------------
    Fix Version/s: 1.16.0

> Validate order query parameter on datatables endpoint against actual table columns
> ----------------------------------------------------------------------------------
>
>                 Key: FINERACT-2735
>                 URL: https://issues.apache.org/jira/browse/FINERACT-2735
>             Project: Apache Fineract
>          Issue Type: Bug
>            Reporter: Terence Monteiro
>            Assignee: Terence Monteiro
>            Priority: Major
>             Fix For: 1.16.0
>
>
> Currently, the {{order}} query parameter accepted by the datatables read endpoints (e.g. {{{}GET /datatables/\{datatable}/\{apptableId}{}}}) is passed through without sufficient validation. This ticket proposes validating {{order}} against the datatable's actual column list before it's used to build the query, consistent with how sorting is already restricted on the offices endpoint.
> *Proposed behavior:*
>  * {{order}} must reference a single column that exists on the target datatable (verified against the table's resolved column metadata).
>  * An optional {{ASC}} / {{DESC}} direction token may follow the column name (case-insensitive).
>  * Column names containing spaces or other characters must be quoted, using either double quotes ({{{}"Column Name"{}}}) or backticks ({{{}`Column Name`{}}}) — consistent with standard SQL identifier-quoting conventions across PostgreSQL, MySQL, and MariaDB. Quoting is optional for column names that don't require it.
>  * Multiple columns (comma-separated) are not supported, matching the existing convention on the offices endpoint.
>  * Requests with an {{order}} value that doesn't resolve to a real column, or that use invalid syntax, will be rejected with a clear error rather than silently ignored or passed through.
> *Motivation:*
>  * Brings datatables sorting behavior in line with the existing, simpler convention already used elsewhere (offices endpoint).
>  * Improves input validation and predictability of API behavior.
>  * Removes ambiguity around how column names containing spaces are interpreted in the {{order}} parameter.
> *Acceptance criteria:*
>  * Valid single-column {{order}} values (quoted or unquoted, with or without direction) return correctly sorted results.
>  * {{order}} values referencing a non-existent column are rejected with an appropriate error response.
>  * {{order}} values using unsupported syntax (multiple columns, malformed quoting, invalid direction token) are rejected with an appropriate error response.
>  * Existing API consumers using single-column, unquoted, no-space column names for {{order}} continue to work unchanged.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)