[
https://issues.apache.org/jira/browse/SOLR-18238?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137994#comment-18137994
]
Jason Gerlowski commented on SOLR-18238:
----------------------------------------
I'm also surprised - my first thought on reading this ticket was: "Oh I bet
there's some JAX-RS/Jersey framework stuff to at least enforce basic
validation". I haven't researched it a ton to point to any particular
mechanism though.
I know there's annotations like {{@NotBlank}} that Jersey will enforce, but
that requires you to remember the annotation in each relevant place. So it's
slightly less verbose than having the validation in the method body itself, but
otherwise not much better.
You could probably also put "default" validation in place by implementing a
"ContainerRequestFilter" that Jersey runs on each request that can inspect any
URI parameters and make sure they meet our requirements. We have a few of
those already, though none for input-validation specifically.
But those are the two best options I'm aware of.
> Add Stronger Validation to V2 API Parameters
> --------------------------------------------
>
> Key: SOLR-18238
> URL: https://issues.apache.org/jira/browse/SOLR-18238
> Project: Solr
> Issue Type: Bug
> Components: v2 API
> Affects Versions: 10.0
> Reporter: Eric Pugh
> Priority: Minor
>
> We have very inconsistent validation across our V2 apis for things like
> pathParam and queryParams. For example, I recently discovered that in the
> ConfigSets API DELETE it would accept a " " as a configset name!
> It would be interesting to explore if we could have some validation that
> worked across our Java v2 apis, and maybe could also be used by the Solr UI
> as well.
>
> I can imagine:
> * Investigating the Jax RS Bean validation code.
> * Establishing much stronger patterns in our own Java API code that
> validates using the same util methods across all APIS (strong patterns make
> it easier for the next person to do the right thing)
> * Something around generating validation code in the OpenAPI spec generated
> language clients?
>
> This would be a great ticket for someone familiar with modern web dev
> techniques to contribute to Solr!
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
