Terence Monteiro created FINERACT-2761:
------------------------------------------
Summary: Validate orderBy query parameters for Center listing
Key: FINERACT-2761
URL: https://issues.apache.org/jira/browse/FINERACT-2761
Project: Apache Fineract
Issue Type: Bug
Reporter: Terence Monteiro
Assignee: Terence Monteiro
Fix For: 1.16.0
{{CenterReadPlatformServiceImpl}} builds SQL for the plain and paginated Center
listing endpoints ({{{}GET /centers{}}}) by concatenating caller-supplied
{{{}orderBy{}}}/{{{}sortOrder{}}} values before validating them, rather than
validating each parameter independently before use. Same pattern already fixed
for runreports and offices.
*Fix:*
* Validate {{orderBy}} via allow-list check before it's appended to the query.
* Restrict {{sortOrder}} to a strict {{{}ASC{}}}/{{{}DESC{}}} allow-list.
* Applied to both the plain and paginated listing methods.
*Testing:* Regression tests added in {{CenterIntegrationTest}} for both
endpoints — malicious {{orderBy}} and invalid {{sortOrder}} values now expect
{{{}400{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
