[Bug] changed path for error handling for apis (#459) (#461)

* [Bug] changed path for error handling for apis * added input validation for pipeline and index --------- (cherry picked from commit 18b87d9) Signed-off-by: sumukhswamy <sumukhhs@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
opensearch-project · Oct 22, 2024 · 5662aa8 · 5662aa8
1 parent f5b0e4f
commit 5662aa8
Showing 1 changed file with 24 additions and 1 deletion.
diff --git a/server/routes/dsl_route.ts b/server/routes/dsl_route.ts
@@ -49,6 +49,19 @@ export function registerDslRoute(router: IRouter,  openSearchServiceSetup: OpenS
         const start = performance.now();
         try {
           let resp;
+          const invalidCharactersPattern = /[\s,:\"*+\/\\|?#><]/;
+          if (index !== index.toLowerCase() || index.startsWith('_') || index.startsWith('-') || invalidCharactersPattern.test(index)) {
+            resBody.errorMessage1 = {
+              statusCode: 400,
+              body: 'Invalid Index or missing',
+            };
+          }
+          if (pipeline !== '*' && pipeline !== '_none'  && pipeline !== '' && !(/^[a-zA-Z0-9_\-*]+(,[a-zA-Z0-9_\-*]+)*$/.test(pipeline))){
+            resBody.errorMessage1 = {
+              statusCode: 400,
+              body: 'Invalid Pipepline',
+            }; 
+          }
           if(dataSourceEnabled && dataSourceId1){
             const client = context.dataSource.opensearch.legacy.getClient(dataSourceId1);
             resp = await client.callAPI('search', params);
@@ -107,6 +120,16 @@ export function registerDslRoute(router: IRouter,  openSearchServiceSetup: OpenS
         const start = performance.now();
         try {
           let resp;
+          const invalidCharactersPattern = /[\s,:\"*+\/\\|?#><]/;
+          if (index !== index.toLowerCase() || index.startsWith('_') || index.startsWith('-') || invalidCharactersPattern.test(index)) {
+            throw new Error("Index invalid or missing.");
+          }
+          if (pipeline !== '*' && pipeline !== '_none'  && pipeline !== '' && !(/^[a-zA-Z0-9_\-*]+(,[a-zA-Z0-9_\-*]+)*$/.test(pipeline))){
+            resBody.errorMessage1 = {
+              statusCode: 400,
+              body: 'Invalid Pipepline',
+            }; 
+          }
           if(dataSourceEnabled && dataSourceId2){
             const client = context.dataSource.opensearch.legacy.getClient(dataSourceId2);
             resp = await client.callAPI('search', params);
@@ -195,7 +218,7 @@ export function registerDslRoute(router: IRouter,  openSearchServiceSetup: OpenS
         );
         if (error.statusCode !== 404) console.error(error);
         return response.custom({
-          statusCode: error.statusCode || 500,
+          statusCode: error.statusCode || 400,
           body: error.message,
         });
       }