Foo Developer created FINERACT-2862:
---------------------------------------
Summary: Datatable entry with a non-numeric value for a dropdown
(code lookup) column fails with HTTP 500 instead of a validation error
Key: FINERACT-2862
URL: https://issues.apache.org/jira/browse/FINERACT-2862
Project: Apache Fineract
Issue Type: Bug
Components: Data Tables
Reporter: Foo Developer
Assignee: Foo Developer
h3. Summary
Submitting a non-numeric value for a datatable dropdown (code lookup) column
returns HTTP 500 instead of a 400 validation error, as soon as the column's
code has at least one code value.
h3. Steps to reproduce (stock Fineract)
# Create a code and give it a value:
{code}POST /fineract-provider/api/v1/codes
{"name": "DocType"}
POST /fineract-provider/api/v1/codes/{codeId}/codevalues
{"name": "Passport", "position": 1, "isActive": true}
{code}
# Create a client datatable with a dropdown column bound to that code:
{code}POST /fineract-provider/api/v1/datatables
{
"datatableName": "dt_client_doc",
"apptableName": "m_client",
"entitySubType": "Person",
"multiRow": false,
"columns": [
{"name": "DocType", "type": "Dropdown", "code": "DocType", "mandatory":
false}
]
}
{code}
# Add an entry for an existing client, sending a non-numeric value for the
dropdown column (the column is named {{DocType_cd_DocType}}):
{code}POST /fineract-provider/api/v1/datatables/dt_client_doc/{clientId}
{"DocType_cd_DocType": "abc"}
{code}
The same happens when the datatable entry is embedded in {{POST /v1/clients}}
through the {{datatables}} array, so client creation fails with a 500.
h3. Expected
HTTP 400 with {{error.msg.invalid.columnValue}} ("Value not found in Allowed
Value list"), the same error already returned for a numeric id that is not one
of the code's values.
h3. Actual
HTTP 500 (reproduced on {{develop}} at 213f517b88). The body is a generic
{{Internal Server Error}} with no validation details, and the log shows an
uncaught {{java.lang.NumberFormatException: For input string: "abc"}}.
h3. Root cause
{{SearchUtil.parseColumnValue}} (fineract-core), in the
{{columnHeader.isCodeLookupDisplayType()}} branch, parses the submitted value
with a bare {{Integer.valueOf(columnValue)}}. That branch is only entered when
{{columnHeader.hasColumnValues()}} is true, which is why the defect appears
only once the code has values; with an empty code the value takes the generic
integer parsing path instead. The {{NumberFormatException}} is not translated
into a validation error, so it reaches the client as a 500. The same method
also parses datatable query filter values, so the advanced datatable query path
is affected the same way.
h3. Proposed fix
Catch {{NumberFormatException}} around the parse and raise the same
{{PlatformApiDataValidationException}} ({{error.msg.invalid.columnValue}},
"Value not found in Allowed Value list") that the sibling "not in allowed list"
check just below already throws. A non-numeric value is, from the caller's
point of view, exactly a value that is not in the allowed list.
h3. Tests
A new unit test {{SearchUtilTest}} in fineract-core covering a code-lookup
column: a non-numeric value raises {{PlatformApiDataValidationException}} (it
raises {{NumberFormatException}} without the fix), a numeric id outside the
list raises the same error, and an allowed id is returned as an {{Integer}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
