I am using Jersey 2.x.
I have a GET Request with the following method signature :
#GET
#Path("/size/file/{fileName}")
#Produces("application/json")
public Response getFileSize(#PathParam("fileName") String filename,
#Context ContainerRequestContext crc) {
......
......
}
I hit my URL in the following two ways :
http://localhost:8083/sample/size/file/hello_____
http://localhost:8083/sample/size/file/hello#$
please notice the #$ in the 2nd request.
When I check the parameter in GET Request using IDE Watcher , for the first request the fileName is hello_____ and output is invalid file name.
For the second one when I checked the parameter I found it as hello, I wonder where the #$ gone ?
I have the following questions with the above context.
Why the GET request accepted _____ but not #$ (in the backend)?
What happened to #$ did the jersey cleared the special characters itself ?
I tried passing # then the output is invalid file name, why this time # is not cleared as in case of #$ ?
Is this is a sql injection and can affect my API. If yes then how to handle such scenarios. What actions to take to prevent this ?
I hope I am clear with my questions.
Thank you
Related
I have a problem when trying to retrieve data from Manage Price Quote Details (PriceQuoteServicesRQ) 4.10 Sabre SOAP API.
I generated Java classes using the WSDL from Sabre website (https://developer.sabre.com/docs/soap_apis/air/fulfill/manage_price_quote_details/resources).
I am constructing my request object in a following way:
ReservationTypeShort reservation = new ReservationTypeShort();
reservation.setValue("YEZUYS");
PriceQuoteInfoSearchParameters info = new PriceQuoteInfoSearchParameters();
info.setReservation(reservation);
PriceQuoteSearchParameters searchParameters = new PriceQuoteSearchParameters();
searchParameters.getPriceQuoteInfo().add(info);
searchParameters.setResultType(StringResultType.S);
GetPriceQuoteRQ req = new GetPriceQuoteRQ();
req.setSearchParameters(searchParameters);
req.setVersion("4.1.0");
I pretty-printed the object and this is what I got:
"priceQuoteInfo" : [ {
"reservation" : {
"value" : "YEZUYS",
"createDate" : null
},
"status" : [ ],
"type" : null,
"priceQuote" : [ ],
"travelItinerary" : null
} ],
So according to their documentation:
I am supplying all fields that are necessary, however it still doesn't work for me.
Did anybody else had the same problem? What am I missing/what am I doing wrong?
This is the error message I am getting:
XML request schema validation failed: PriceQuoteInfo element is not complete. One of the following fields: Status, Type, PriceQuote, TravelItinerary should be used. Please amend your request and try again.
What I have tried so far?
I asked Sabre Support for help, but they responded with a message that basically says "it works on my end".
I intercepted the XML body:
<ns5:GetPriceQuoteRQ version="4.1.0">
<ns5:SearchParameters resultType="S">
<ns5:PriceQuoteInfo>
<ns5:Reservation>YEZUYS</ns5:Reservation>
</ns5:PriceQuoteInfo>
</ns5:SearchParameters>
</ns5:GetPriceQuoteRQ>
I was missing an empty element <PriceQuote/> in my request.
It can be added by doing:
PriceQuoteInfoSearchParameters info = new PriceQuoteInfoSearchParameters();
info.setReservation(reservation);
info.getPriceQuote().add(new PriceQuoteSearch());
So according to their documentation I am supplying all fields that are necessary [...]
By documentation do you mean the WSDL or some human readable documentation (like PDF, DOCX, web pages, etc)? According to the error message you get, your SOAP request isn't valid. Sabre Support responding with "it works on my end" is another way of saying that you are not doing something correctly on your end. You need to troubleshoot your request.
From what I see, the error message is saying Status, Type, PriceQuote, and TravelItinerary but you are sending status, type, priceQuote, and travelItinerary. XML is case sensitive, and it's possible the service field names are too, so this might be the first thing to check.
Then, two of your fields (type and travelItinerary) are null. Also, priceQuote is empty. Is that OK? This is the next thing to check.
The object you pretty-printed shows a JSON format. Is this actually the format you are sending on the wire to the service? SOAP wants XML, not JSON. You also mention you generated the code from the WSDL. Using what framework or library? Does the generated code send XML?
Like I said, you need to troubleshoot the call:
download SoapUI
feed the WSDL file to SoapUI so that it can generate sample requests for you
fill in those request with real data and make calls to the web service until you get back a successful and expected response
using the same parameters from 3) in your code, perform the same call using your code
use SoapUI's monitoring tools to intercept the request at 4) and inspect the SOAP message you are sending
check the request you are making with your code against the successful request you got by using SoapUI directly
correct any differences until your request made by code is like the one send from SoapUI and it returns a successful and expected response.
I want to change data on a server via a put request, but I always get a 401 [no body] error. The response looks like the following:
I do not really understand why I get this error, because my body is not empty. My code looks like this and the values seem to be okay too. Does anyone have any idea what I'm doing wrong?
Postman Update:
The values are different right now (consent and authorisation) since its basically a new request but the values were correct before too so this change should not make a difference.
Looks like you are simply passing invalid authorization header, or maybe not passing it at all.
What happens is that you make a RestTemplate exchange call, then you get 401 from that request, and Spring propagates it and returns 500 - Internal Server Error, because there is no error handling in place.
EDIT: According to your screenshots, you are not replacing your path variables. Update the way you build your URL as listed below.
Map<String, String> pathVars = new HashMap<>(2);
pathVars.put("consent-id", consentId);
pathVars.put("authorisation-id", authorisationId);
UriComponents uri = UriComponentsBuilder.fromUri(mainLink)
.path("consents/{consent-id}/authorizations/{authorisation-id}")
.buildAndExpand(pathVars);
Verify if your authorization-id is correct
if the token has a type for example Bearer you must write so:
"Authorization": "Bearer rrdedzfdgf........."
and make sure that there is only one space between Bearer and the token
Often the problem comes from the browser locally;
if your site is online, save the part and deploy the last modifications of the site and make the test
otherwise if it is a mobile application test it on a smartphone and not a browser;
in case none of this works, do it with your backend, it works with this
I had a problem where the I would add an extra character to a password. And Insomnia(Or Postman) would return a JSON response from the server along with a 401 HTTP status code. But when I did the same thing inside a springboot app, when using catch(HttpServerErrorException e){System.out.prinln(e.getMessage());} the e.getMessage would have [no body]. I think that is a feature built in the HttpServerErrorException class where it doesn't provide the body for security purposes. Since whoever is requesting is not authorized they should not have access to it.
I successfully authenticated to google play developer rest api and I am getting also the refresh token but I can figure out how to make an edit requests.
I have method signature at the following link:
https://developers.google.com/android-publisher/api-ref/edits/insert
I added the following header
Authorization:{{token_type}} {{access_token}}
but i cant figure out where to put the package name:
POST https://www.googleapis.com/androidpublisher/v2/applications/packageName/edits
I putted packageName like above using get and also as post parameter and in both cases i am encountered "404 not found" error.
Please help.
You can try
POST https://www.googleapis.com/androidpublisher/v2/applications/edits?id = packageid && expiryTimeSeconds = 20
GET https://www.googleapis.com/androidpublisher/v2/applications/**packageName**/edits/**editId**
according to
https://developers.google.com/android-publisher/api-ref/edits#methods
Please verify if you have followed all steps for authentication and authorization as shown here.
Since you are not getting 401 or 403, you might be sending the token correctly.
To call the api:
put your package name as a path paramters and specify the edit resource in the body. Please note that the edit resource is ignored but needs to be provided.
send your request like this:
POST https://www.googleapis.com/androidpublisher/v2/applications/yourPackageNameHere/edits
in the body:
{
"id": "abcd",
"expiryTimeSeconds": "asd"
}
make sure u provide content type in header as well.
Authorization is also required in the headers as you mentioned.
Hope this helps. :)
I am working on designing the REST APIs. One of the POST request to create a room in a home takes an input of ID of the home and room name like :
POST /webCall/development/construction
<?xml version="1.0"?><room><home id='110001'/><name>large bedroom</name></room>
So my question here is,suppose the home ID = 110001, doesn't exist in the system, In that case should 404(Resource not found) be the response code or 412(Precondition failed) be the response code.
Possible arguements.
Why 404 : The resource home with ID : 110001 is not found.
Why 412 : The precondition to create a room is that a home should exist,which fails here.
Please provide your suggestions with reasoning, that would help me to take right decision.
412 is incorrect for the reason given by Sotirios.
404 is incorrect because the problem is with the payload, not the addressed resource (URI).
You could use 400 (generic), 409 or 422.
The HTTP spec says the following about the 412 status code
The precondition given in one or more of the request-header fields
evaluated to false when it was tested on the server. This response
code allows the client to place preconditions on the current resource
metainformation (header field data) and thus prevent the requested
method from being applied to a resource other than the one intended.
So this status code would make sense if you were sending an If-Match header with the
entity tag of the resource you're trying to add to.
Assuming you're posting to something like below
/homes/some-identifier/rooms
you should probably be returning a 404, since the resource /homes/some-identifier/rooms does not exist.
If you are actually doing
POST /webCall/development/construction
<?xml version="1.0"?><room><home id='110001'/><name>large bedroom</name></room>
then 409 would probably be the most appropriate. However, I recommend you change your API to POST to the actual home resource.
Sorry if this is a duplicate question but google isn't smart enough to understand me or I'm too dumb to express my question simple enough for it to understand.
I don't know if this is my problem but I'm 90% sure this is it.
I'd like to know how to represent a Unix path within a GET request so that my web service doesn't return a 404. I think it's because one of my JSON fields in the query is a Unix path and because of the slashes, the webservice thinks it's part of the URL and not a part of my query.
For example, I'm using a RESTClient that's an add-on to Mozilla to test my web service. For the POST request, I enter as the url
http://mytestserver:8080/mydir/
and in the body, I put in my JSON object
{"filename":"obit.jpg", "Path":"test/2/1"}
This method works fine. I get a status code 200 and a return JSON object with the expected output.
When I use the same string for a GET request, I get a status code 404 and no return JSON object. I put as the url in the RESTClient
http://mytestserver:8080/mydir/{"filename":"obit.jpg", "Path":"test/2/1"}
and I get a status code 404 and the response body just says 404 - Not found
To further test my theory, I entered the following url in a GET request, removing the /2/1 from the path, which works.
http://mytestserver:8080/mydir/{"filename":"obit.jpg", "Path":"test"}
I've tried encapsulating the whole JSON string in quotes but that didn't work either so I've run out of things to try.
Thanks in advance for any help you can give me. If I need to show some code, please let me know, although, I don't think it's a code problem, I think it's a representation problem. Thanks.
Found out that JSON objects are usually sent via POST, not GET. Since I appended it to the URL via GET, it gave me problems. Per How to send a GET request with a "/" in the query