api: an unknown last_dag_run_state filter answers 500 instead of 400
Maintainers usually reply within 1 day
A pull request for this has already been merged.
- #2211 by @neochaotic — merged
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start with parseDagRunFilter and trace how last_dag_run_state reaches the enum cast in internal/storage/repo_dags.go; check how the public API and UI list pass the filter through in internal/api/resources.go and internal/api/ui_dags.go. Validate against the run states and return HTTP 400 for an unknown value, as date parsing already does. Done means an unknown filter no longer produces HTTP 500 and the valid run states still work.
Written by the indexing model from the issue text.
Description
GET /api/v2/dags?last_dag_run_state=<unknown value> answers 500 internal error on v0.5.7-rc.1:
{"type":"about:blank","title":"internal error","status":500,"detail":"the request could not be completed; see the server logs","instance":"/api/v2/dags"}
The raw value is cast to the dag_run_state enum in internal/storage/repo_dags.go and Postgres refuses the cast. The public GET /api/v2/dags (internal/api/resources.go) and the UI list (internal/api/ui_dags.go) both pass it through. Nothing leaks, but a client mistake shows up as a server fault and counts toward the 5xx alert.
Validate the value against the run states and answer 400, the way parseDagRunFilter already does for dates.
From the v0.5.7-rc.1 security review (F4 in rc1-security-review.md, #2199), reproduced on the published rc.1 binary.
Generated by Claude Code
- Dominant language
- Go
- Stars
- 46
- Forks
- 1
- Avg merge
- 13h 9m
- Merged PRs (30d)
- 686
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from dexadata/dexaflow
-
area/docs documentation priority/p3
Difficulty 1/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
area/ci enhancement priority/p3
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
area/api priority/p3
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 3-5 days Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
All issues in dexadata/dexaflow
Similar issues
-
ux
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
evcc-io/evcc#35605 · 1 comment ·
Maintainers usually reply within 1 day
-
bug report
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
type:bug
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
nightgauge/nightgauge#2732 ·
Maintainers usually reply within 1 day
-
fix below CVEsOpenbug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 5 days
-
good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 78/100