fix: avoid parsing search malformed requests

quickwit-oss · Nov 21, 2023 · 86a7477 · 86a7477
1 parent 3f18626
commit 86a7477
Showing 1 changed file with 25 additions and 3 deletions.
diff --git a/quickwit/quickwit-serve/src/elastic_search_api/model/search_body.rs b/quickwit/quickwit-serve/src/elastic_search_api/model/search_body.rs
@@ -53,6 +53,7 @@ struct FieldSortParams {
 }
 
 #[derive(Debug, Default, Clone, Deserialize, PartialEq)]
+#[serde(deny_unknown_fields)]
 pub struct SearchBody {
     #[serde(default)]
     pub from: Option<u64>,
@@ -164,7 +165,7 @@ mod tests {
             ]
         }
         "#;
-        let search_body: super::SearchBody = serde_json::from_str(json).unwrap();
+        let search_body: SearchBody = serde_json::from_str(json).unwrap();
         let sort_fields = search_body.sort.unwrap();
         assert_eq!(sort_fields.len(), 5);
         assert_eq!(sort_fields[0].field, "timestamp");
@@ -189,7 +190,7 @@ mod tests {
             }
         }
         "#;
-        let search_body: super::SearchBody = serde_json::from_str(json).unwrap();
+        let search_body: SearchBody = serde_json::from_str(json).unwrap();
         let field_sorts = search_body.sort.unwrap();
         assert_eq!(field_sorts.len(), 2);
         assert_eq!(field_sorts[0].field, "timestamp");
@@ -210,7 +211,7 @@ mod tests {
             ]
         }
         "#;
-        let search_body: super::SearchBody = serde_json::from_str(json).unwrap();
+        let search_body: SearchBody = serde_json::from_str(json).unwrap();
         let field_sorts = search_body.sort.unwrap();
         assert_eq!(field_sorts.len(), 4);
         assert_eq!(field_sorts[0].field, "timestamp");
@@ -222,4 +223,25 @@ mod tests {
         assert_eq!(field_sorts[3].field, "_doc");
         assert_eq!(field_sorts[3].order, SortOrder::Asc);
     }
+
+    #[test]
+    fn test_unknown_field_behaviour() {
+        let json = r#"
+            {
+                "term": {
+                    "actor.id": {
+                        "value": "95077794"
+                     }
+                }
+            }
+        "#;
+
+        let search_body = serde_json::from_str::<SearchBody>(json);
+        assert!(search_body.is_err());
+        assert_eq!(
+            search_body.err().unwrap().to_string(),
+            "unknown field `term`, expected one of `from`, `size`, `query`, `sort`, `aggs`, \
+             `track_total_hits`, `stored_fields`, `search_after` at line 3 column 22"
+        );
+    }
 }