Restrict User Input

medizininformatik-initiative · Jul 11, 2024 · b13a447 · b13a447
1 parent 6420955
commit b13a447
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/clinical-domain-agent/src/main/java/care/smith/fts/cda/rest/TransferProcessController.java b/clinical-domain-agent/src/main/java/care/smith/fts/cda/rest/TransferProcessController.java
@@ -30,7 +30,7 @@ public TransferProcessController(
     this.processes = processes;
   }
 
-  @PostMapping(value = "/{project:\\w+}/start")
+  @PostMapping(value = "/{project:[\\w-]+}/start")
   Mono<ResponseEntity<Object>> start(
       @PathVariable("project") String project, UriComponentsBuilder uriBuilder) {
     var process = findProcess(project);
@@ -48,7 +48,7 @@ Mono<ResponseEntity<Object>> start(
     } else {
       log.warn("Project '{}' not found", project);
       return internalServerError(
-          new IllegalStateException("Project %s could not be found".formatted(project)));
+          new IllegalStateException("Project '%s' could not be found".formatted(project)));
     }
   }
 

diff --git a/...nsferProcessDefinitionControllerTest.java → ...a/rest/TransferProcessControllerTest.java b/...nsferProcessDefinitionControllerTest.java → ...a/rest/TransferProcessControllerTest.java
@@ -64,7 +64,7 @@ void startNonExistingProjectErrors() {
             ResponseEntity.of(
                     ProblemDetail.forStatusAndDetail(
                         HttpStatus.INTERNAL_SERVER_ERROR,
-                        "Project non-existent could not be found"))
+                        "Project 'non-existent' could not be found"))
                 .build())
         .verifyComplete();
   }

diff --git a/clinical-domain-agent/src/test/java/care/smith/fts/cda/rest/it/GeneralIT.java b/clinical-domain-agent/src/test/java/care/smith/fts/cda/rest/it/GeneralIT.java
@@ -73,7 +73,7 @@ void invalidProject() {
                         c.bodyToMono(ProblemDetail.class)
                             .flatMap(p -> Mono.error(new IllegalStateException(p.getDetail()))))
                 .toBodilessEntity())
-        .expectErrorMessage("Project non-existent could not be found")
+        .expectErrorMessage("Project 'non-existent' could not be found")
         .verifyThenAssertThat()
         .hasOperatorErrors();
   }