Bug 32713: Throw exception on unexpected x-koha-embed header

This patch adds an exception to stash_embed that is thrown when we
find an x-koha-embed header that we're not expecting.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>

diff --git a/Koha/REST/Plugin/Query.pm b/Koha/REST/Plugin/Query.pm
index 5ce0da4..432a0d8 100644 (file)
--- a/Koha/REST/Plugin/Query.pm
+++ b/Koha/REST/Plugin/Query.pm
@@ -228,7 +228,7 @@ Merges parameters from $q_params into $filtered_params.
 
 =head3 stash_embed
 
-    $c->stash_embed();
+    $c->stash_embed( { spec => $op_spec } );
 
 Unwraps and stashes the x-koha-embed headers for use later query construction
 
@@ -237,14 +237,28 @@ Unwraps and stashes the x-koha-embed headers for use later query construction
     $app->helper(
         'stash_embed' => sub {
 
-            my ( $c ) = @_;
+            my ( $c, $args ) = @_;
+
             my $embed_header = $c->req->headers->header('x-koha-embed');
+            return $c unless $embed_header;
+
+            my $spec = $args->{spec} // {};
+            my $embed_spec;
+            for my $param ( @{ $spec->{parameters} } ) {
+                next unless $param->{name} eq 'x-koha-embed';
+                $embed_spec = $param->{items}->{enum};
+            }
+            Koha::Exceptions::BadParameter->throw(
+                "Embedding objects is not allowed on this endpoint.")
+              unless defined($embed_spec);
+
             if ($embed_header) {
                 my $THE_embed = {};
                 foreach my $embed_req ( split /\s*,\s*/, $embed_header ) {
                     if ( $embed_req eq '+strings' ) {    # special case
                         $c->stash( 'koha.strings' => 1 );
-                    } else {
+                    }
+                    else {
                         _merge_embed( _parse_embed($embed_req), $THE_embed );
                     }
                 }

diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
index 8e8a6f6..1b2a9c0 100644 (file)
--- a/Koha/REST/V1/Auth.pm
+++ b/Koha/REST/V1/Auth.pm
@@ -157,7 +157,7 @@ sub authenticate_api_request {
     # TODO: remove the latter 'openapi.op_spec' if minimum version is bumped to at least 1.17.
     my $spec = $c->openapi->spec || $c->match->endpoint->pattern->defaults->{'openapi.op_spec'};
 
-    $c->stash_embed();
+    $c->stash_embed( { spec => $spec } );
     $c->stash_overrides();
 
     my $cookie_auth = 0;