Repository navigation
Reject graph descriptors without an object id - #1425
Merged
tomchop merged 1 commit intoOct 25, 2026
Merged
Conversation
check_id_descriptor() accepted "indicators/", so /graph/add and
/graph/search called .get("") and ArangoDB's DocumentGetError
escaped as a 500. Validate that the id part is non-empty so both
endpoints answer 422.
Fixes #1414.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1414.
check_id_descriptor()checks that asource/targethas exactly one/and that the type is inGRAPH_TYPE_MAPPINGS, but not that there is anything after the slash."indicators/"passes validation, so the handler calls.get(""), and ArangoDB rejects the empty key withDocumentGetError(HTTP 404, ERR 1203) instead of returningNone. The error escapes the handler and the client gets a 500.The same validator is used by
GraphSearchRequest, soPOST /api/v2/graph/searchwith"source": "observables/"hits the same path.Change
check_id_descriptor()now also rejects an empty id, so both endpoints answer 422 (source is missing the object id) before touching the database. The two.get()calls in the handlers are unchanged.Verification
Against ArangoDB 3.11 and Redis from
extras/docker/dev/docker-compose.yaml, with the environment fromunittests.yml:test_add_link_missing_id(empty source id, empty target id) andtest_get_neighbors_missing_id. Onmainboth fail witharango.exceptions.DocumentGetError: [HTTP 404][ERR 1203] expecting GET /_api/document/<collection>/<key>; with the fix they pass.pytest tests/apiv2/graph.py: 28 passed;pytest tests/apiv2: 247 passed.ruff checkandruff format --checkon the changed files pass.