[
https://issues.apache.org/jira/browse/FINERACT-2935?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126754#comment-18126754
]
raashed commented on FINERACT-2935:
-----------------------------------
[~adamsaghy] Thanks! PR is up: https://github.com/apache/fineract/pull/6637
I went with 400: \{{ContentPolicyException}} now extends
\{{PlatformApiDataValidationException}}, so a rejected upload returns 400 with
the policy message on the \{{file}} parameter. It includes a unit test for the
mapping and a \{{FeignDocumentTest}} case that uploads a .txt and expects 400.
Happy to switch to 403 if you'd prefer.
> Document upload returns HTTP 500 when a content policy rejects the file
> (e.g. disallowed file type)
> ----------------------------------------------------------------------------------------------------
>
> Key: FINERACT-2935
> URL: https://issues.apache.org/jira/browse/FINERACT-2935
> Project: Apache Fineract
> Issue Type: Bug
> Components: System
> Affects Versions: 1.15.0
> Reporter: raashed
> Priority: Minor
>
> Uploading a document whose file type is not on the whitelist (e.g. a {{.txt}}
> file to \{{POST /v1/clients/<clientId>/documents}} is correctly rejected by
> {{{}WhitelistContentPolicy{}}}, but the API responds with *HTTP 500* instead
> of a client error.
> *Cause*
> {{ContentPolicyException}} (fineract-document,
> {{{}infrastructure.contentstore.exception{}}}) extends the bare
> {{{}AbstractPlatformException{}}}, which has no dedicated exception mapper,
> so it falls through to {{{}DefaultExceptionMapper{}}}, which always returns
> 500. This affects every content policy that throws it:
> * {{WhitelistContentPolicy}} (file name / mime type not allowed)
> * {{MimeContentPolicy}} (declared vs. detected mime type mismatch)
> * {{TraversalContentPolicy}} (path traversal)
> *Expected*
> A 4xx response with a message saying why the file was rejected (e.g. 400 as a
> validation error).
> *Proposed fix*
> Make {{ContentPolicyException}} map to a 4xx response, and add
> unit/integration tests covering a rejected upload.
> I'd like to work on this.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
