Page MenuHomePhabricator

REST: request body validation should fail if unexpected fields are present
Closed, ResolvedPublic

Description

The default validation for request bodies (per T358850 and T358557) should fail if the bodiy contains an unexpected field. This is useful of the client is trying to supply an optional fields under the wrong name, see https://gerrit.wikimedia.org/r/c/mediawiki/core/+/809322 I854046efe which implements this for JsonBodyValidator.

Event Timeline

Change 1012690 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[mediawiki/core@master] REST: detect extraneous body fields

https://gerrit.wikimedia.org/r/1012690

daniel triaged this task as High priority.

Couldn’t it be just a warning, like in the action API? There are cases in which it’s less convenient or even hardly possible to ensure no extra fields:

  • Two similar endpoints, one of which expects more data, and the caller decides last-minute which one to call.
  • The caller function gets data in a parameter, it processes some fields and passes the rest to the API; it doesn’t want to make a copy with only the fields actually used by the API.
  • Some fields are required on one wiki but unexpected on another (e.g. due to an extension being installed only on some wikis), and the caller isn’t able/willing to maintain a list of wikis that require that field.

Change #1012690 merged by jenkins-bot:

[mediawiki/core@master] REST: detect extraneous body fields

https://gerrit.wikimedia.org/r/1012690

daniel moved this task from In Progress to Needs Further Discussion on the MW-Interfaces-Team board.
daniel moved this task from Needs Further Discussion to Done on the MW-Interfaces-Team board.