tanishqgandhi1908 opened a new issue, #9098:
URL: https://github.com/apache/texera/issues/9098
### What happened?
Two dataset endpoints skip input checks that the matching model endpoints
already make, so bad input produces a 500 instead of a 4xx:
A version from another dataset. /dataset/{did}/version/{dvid}/rootFileNodes,
its public twin /dataset/{did}/publicVersion/{dvid}/rootFileNodes, and
/dataset/{did}/versionZip?dvid= check access on did but then load version dvid
without checking it belongs to did. Asking a public dataset for a private
dataset’s version id reads that other dataset’s version record and then fails
at LakeFS, which returns a 500. The model side scopes the lookup to the model
(getModelVersionByID(ctx, mid, mvid)).
No type on multipart upload. POST /dataset/multipart-upload without type
calls toLowerCase on null, which returns a 500. The model endpoint returns a
400 listing the valid types.
Expected: a 404 for a version that isn’t part of the dataset, and a 400 for
a missing or unknown type, as the model endpoints do.
```
$ curl /api/dataset/215/publicVersion/16/rootFileNodes # public dataset
215, version 16 of private dataset 216 (no login)
-> HTTP 500
$ curl /api/dataset/215/publicVersion/15/rootFileNodes # its own version
-> HTTP 200
$ curl -X POST
"/api/dataset/multipart-upload?ownerEmail=...&datasetName=public-weather&filePath=x.csv"
# no type
-> HTTP 500 (NullPointerException: "operationType" is null)
$ same request against /api/model/multipart-upload
-> HTTP 400 {"message":"Invalid type parameter. Use 'list', 'init',
'finish', 'abort'."}
```
### How to reproduce?
1. Create a public dataset A and a private dataset B, each with one version.
2. GET /api/dataset/{A}/publicVersion/{B's version id}/rootFileNodes, with
no login, returns 500.
3. POST
/api/dataset/multipart-upload?ownerEmail=...&datasetName={A}&filePath=x.csv,
signed in and with no type, returns 500.
### Version/Branch
1.4.0-incubating-SNAPSHOT (main)
### Commit Hash (Optional)
_No response_
### What browsers are you seeing the problem on?
_No response_
### Relevant log output
```shell
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
