CreateServiceInstanceRequest Class is not handling empty request body exception #329
Milestone
Comments
|
We see this issue in 2.1.x of Spring boot which is using spring broker 3.0.x |
|
@royclarkson @scottfrederick |
|
Thanks for reporting. We'll review and determine a proper fix. |
|
Can you confirm that you are using Spring Boot 2.1 and Spring Cloud Open Service Broker 3.0 and the specific versions of each? Have you tried to upgrade to the latest version 3.3.0 with Spring Boot 2.4? Where are you seeing the complete stack trace? Thanks. |
royclarkson
added a commit
that referenced
this issue
Sep 30, 2021
The OSB spec states "If a Service Broker rejects a request due to a mismatched Content-Type or the body is unprocessable it SHOULD respond with 400 Bad Request" Previously, a request with an empty body or a mismatched content type would result in exceptions being thrown that would be handled by the generic exception handler in Spring Cloud Open Service Broker, which would then return a 500 response. see /~https://github.com/openservicebrokerapi/servicebroker/blob/v2.16/spec.md#content-type closes #329
royclarkson
added a commit
that referenced
this issue
Sep 30, 2021
The OSB spec states "If a Service Broker rejects a request due to a mismatched Content-Type or the body is unprocessable it SHOULD respond with 400 Bad Request" Previously, a request with an empty body or a mismatched content type would result in exceptions being thrown that would be handled by the generic exception handler in Spring Cloud Open Service Broker, which would then return a 500 response. see /~https://github.com/openservicebrokerapi/servicebroker/blob/v2.16/spec.md#content-type closes #329
royclarkson
added a commit
that referenced
this issue
Sep 30, 2021
The OSB spec states "If a Service Broker rejects a request due to a mismatched Content-Type or the body is unprocessable it SHOULD respond with 400 Bad Request" Previously, a request with an empty body or a mismatched content type would result in exceptions being thrown that would be handled by the generic exception handler in Spring Cloud Open Service Broker, which would then return a 500 response. see /~https://github.com/openservicebrokerapi/servicebroker/blob/v2.16/spec.md#content-type closes #329
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When triggered PUT API v2/service_instances/{instance_id} by passing empty request body it gives complete stack trace which reveals the internals of the classes used
This is with spring-cloud-open-service-broker v3.3.0
Please open a CVE and fix this here /~https://github.com/spring-cloud/spring-cloud-open-service-broker/blob/8bdf3d6135b8308d07342eeb741b747596b1cfe0/spring-cloud-open-service-broker-core/src/main/java/org/springframework/cloud/servicebroker/model/instance/CreateServiceInstanceRequest.java
The text was updated successfully, but these errors were encountered: