mchades opened a new issue, #12788:
URL: https://github.com/apache/gravitino/issues/12788
### Version
main branch
### Describe what's wrong
Several create, register, and add REST operations call `request.validate()`
without first rejecting a null request body. Null-safe name extraction only
protects logging and error context; it does not protect the later request
dereference.
Affected operations include:
- Catalog, Schema, Table, Fileset, Topic, Policy, and Tag creation
- Function, Model, and JobTemplate registration
- User, Group, and Role creation
- Bulk user and group creation
An empty or JSON `null` body should return a structured HTTP 400 response,
but these operations currently return HTTP 500 after dereferencing the null
request.
### Error message and/or stacktrace
Expected:
- HTTP 400
- Error code `1001`
- Error type `IllegalArgumentException`
- A message indicating that the request body cannot be null
Actual:
- HTTP 500
- An internal error response
### How to reproduce
Send an authorized create-catalog request with a JSON `null` body:
```shell
curl -i -X POST \
-H 'Content-Type: application/vnd.gravitino.v1+json' \
-H 'Accept: application/vnd.gravitino.v1+json' \
--data 'null' \
'http://localhost:8090/api/metalakes/test/catalogs'
```
The same behavior exists in the affected operations listed above.
### Additional context
#12769 and #12770 fixed this behavior for `createView` and equivalent alter
operations.
The remaining create/register/add operations should follow the existing
`createMetalake` pattern: reject null before `request.validate()` and route an
`IllegalArgumentException` through the corresponding exception handler.
Malformed JSON handling should remain unchanged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
