Skip to content

fix: return 400 when text param is missing in text_search#867

Merged
northdpole merged 1 commit into
OWASP:mainfrom
shiwani42:fix-text-search-none-param
Jun 12, 2026
Merged

fix: return 400 when text param is missing in text_search#867
northdpole merged 1 commit into
OWASP:mainfrom
shiwani42:fix-text-search-none-param

Conversation

@shiwani42

Copy link
Copy Markdown
Contributor

Closes #862

Problem

GET /rest/v1/text_search without a text query parameter causes an
unhandled TypeError deep in re.search() because
request.args.get('text') returns None.

Fix

Return a 400 with a descriptive error message before reaching the
database call. Also handles the empty string case (?text=).

Tests

Added two cases to test_test_search:

  • missing param: 400
  • empty string: 400

@coderabbitai

coderabbitai Bot commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@northdpole, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 11 minutes and 28 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: caab2df2-d579-4142-a2a2-c11e8e2f061b

📥 Commits

Reviewing files that changed from the base of the PR and between 6f339ac and 343bd2b.

📒 Files selected for processing (2)
  • application/tests/web_main_test.py
  • application/web/web_main.py

Walkthrough

This PR adds input validation to the /rest/v1/text_search endpoint to handle missing or empty text query parameters. The endpoint now returns a descriptive HTTP 400 error instead of passing None to the database search function, which previously caused an unhandled TypeError.

Changes

Text Search Validation

Layer / File(s) Summary
Text search parameter validation with tests
application/web/web_main.py, application/tests/web_main_test.py
The text_search route adds an early validation guard that requires a non-empty text query parameter, returning HTTP 400 with error message {"error": "text parameter is required"} if missing or falsy. Test cases verify the endpoint returns 400 for both missing and empty text parameter scenarios.

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The PR title directly reflects the main change: adding validation to return 400 when the text parameter is missing in the text_search endpoint.
Description check ✅ Passed The PR description is related to the changeset, clearly explaining the problem, fix, and tests added to address the issue.
Linked Issues check ✅ Passed The changes fully address issue #862: the endpoint now validates the text parameter and returns 400 (instead of 500) for missing or empty text values, with appropriate test cases added.
Out of Scope Changes check ✅ Passed All changes are scoped to addressing the text_search validation issue; no out-of-scope modifications are present in the test or implementation files.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Closes OWASP#862

request.args.get('text') returns None if the query param is absent.
Passing None into db.text_search() causes re.search() to raise
TypeError: expected string or bytes-like object.
Return a 400 before reaching the database call.
@northdpole northdpole force-pushed the fix-text-search-none-param branch from 6f339ac to 343bd2b Compare June 12, 2026 10:11
@northdpole northdpole merged commit 37417e5 into OWASP:main Jun 12, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GET /rest/v1/text_search without text param causes unhandled TypeError

2 participants