lasdf1234 opened a new issue, #14579:
URL: https://github.com/apache/gravitino/issues/14579
### Version
main branch
### Describe what's wrong
Built-in IdP write endpoints dereference a null request body instead of
returning 400.
Metalake `POST /api/metalakes/{ml}/users` with body `null` correctly returns
400 `Request body cannot be null`. The IdP counterparts do not.
### Error message and/or stacktrace
`PUT /api/idp/users/{user}/password` with body `null`:
```
NullPointerException: Cannot invoke
"org.apache.gravitino.idp.dto.requests.ChangePasswordRequest.validate()"
because "request" is null
at
org.apache.gravitino.idp.web.rest.IdpUserOperations.lambda$changePassword$2(...)
```
Same for `UpdateUserEnabledRequest.validate()` on `PUT …/enabled`.
`POST /api/idp/users` and `POST /api/idp/groups` with `null` or empty body
return HTTP 500 (NPE; `addUser` / `addGroup` also call `request.getUser()` /
`request.getGroup()` outside the guarded lambda path).
`PUT /api/idp/groups/{group}/users` has the same missing null-body guard.
### How to reproduce
1. Basic-auth as admin.
2. `POST /api/idp/users` with `Content-Type: application/json` and body
`null` → 500.
3. Create a user, then `PUT /api/idp/users/{u}/password` with body `null` →
500 NPE on `validate()`.
4. Same for `PUT …/enabled`, `POST /api/idp/groups`, and `PUT
…/groups/{g}/users`.
### Additional context
Root cause: missing null-request guard in `IdpUserOperations` /
`IdpGroupOperations` (unlike metalake `UserOperations.addUser`). One fix should
cover add user, add group, change password, update enabled, and change group
membership.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
