AspNetCoreOData
AspNetCoreOData copied to clipboard
ODataQueryOptions.Validate do not throw for "cast" function in filter with array when AllowedFunctions set AllowedFunctions.None
All versions starting from ASP.NET Core OData 8.0.4+, including 8.0.11. In 8.0.3 it works correctly.
ODataQueryOptions.Validate method doesn't throw exception when "cast" function is used in $filter when AllowedFunctions set AllowedFunctions.None in ODataValidationSettings
Repro
we have following simple EdmModel:
ODataConventionModelBuilder builder = new ODataConventionModelBuilder();
builder.EnableLowerCamelCase();
builder.EntitySet<TestModel>("TestModel");
return builder.GetEdmModel();
public class TestModel
{
/// <summary>
/// Gets or sets MyProperty1
/// </summary>
public int MyProperty1 { get; set; }
/// <summary>
/// Gets or sets Value1
/// </summary>
public string Value1 { get; set; }
}
In query validation settings we don't allow any functions:
var odataValidationSettings = new ODataValidationSettings()
{
AllowedFunctions = AllowedFunctions.None,
AllowedArithmeticOperators = AllowedArithmeticOperators.None,
AllowedLogicalOperators = AllowedLogicalOperators.All,
AllowedQueryOptions = AllowedQueryOptions.Filter
| AllowedQueryOptions.OrderBy
| AllowedQueryOptions.Top
| AllowedQueryOptions.SkipToken
| AllowedQueryOptions.Select,
MaxTop = 1_000,
};
But following GET request doesn't throw ODataException (it considers filter valid):
http://localhost/testmodel?$filter=cast(value1, 'Int32') in [1,2,3]
while these ones throw exception as expected:
http://localhost/testmodel?$filter=cast(value1, 'Int32') eq 3
http://localhost/testmodel?$filter=abs(value1, 'Int32') in [1,2,3]