extra parameter added to container ID in search string causes error
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Evergreen |
New
|
High
|
Unassigned |
Bug Description
Found in PINES when researching server-level library access problems. Crawler bots were performing bib searches over and over with these sorts of error messages (PostgreSQL):
ERROR: invalid input syntax for integer: "2151338?
ERROR: invalid input syntax for integer: "2151338?blimit=10" at character 559
ERROR: invalid input syntax for integer: "2151338?
ERROR: invalid input syntax for integer: "2151338?
ERROR: invalid input syntax for integer: "2151338?locg=184" at character 537
Deeper investigation showed that the query parser code is taking the container ID as-is and trying to use it as an integer in the dynamically generated query:
1623 $with .= " SELECT $rec_field AS record FROM container.
1624 . " JOIN container.
1625 . " WHERE c.btype = " . $self->
1626 . " AND c.id = " . $self->
1627 . " AND (c.pub IS TRUE$perm_join)\n";
Key line is " AND c.id = " . $self->
We need to be sanitizing that data better to prevent this.
Attaching full error output for an example query.