AspNetCoreOData icon indicating copy to clipboard operation
AspNetCoreOData copied to clipboard

ODataQueryOptions.Validate do not throw for "cast" function in filter with array when AllowedFunctions set AllowedFunctions.None

Open bullmastiffo opened this issue 3 years ago • 0 comments

All versions starting from ASP.NET Core OData 8.0.4+, including 8.0.11. In 8.0.3 it works correctly.

ODataQueryOptions.Validate method doesn't throw exception when "cast" function is used in $filter when AllowedFunctions set AllowedFunctions.None in ODataValidationSettings

Repro

we have following simple EdmModel:

ODataConventionModelBuilder builder = new ODataConventionModelBuilder();
builder.EnableLowerCamelCase();
builder.EntitySet<TestModel>("TestModel");
return builder.GetEdmModel();

 public class TestModel 
    {
        /// <summary>
        /// Gets or sets MyProperty1
        /// </summary>
        public int MyProperty1 { get; set; }

        /// <summary>
        /// Gets or sets Value1
        /// </summary>
        public string Value1 { get; set; }
}

In query validation settings we don't allow any functions:

 var odataValidationSettings = new ODataValidationSettings()
            {
                AllowedFunctions = AllowedFunctions.None,
                AllowedArithmeticOperators = AllowedArithmeticOperators.None,
                AllowedLogicalOperators = AllowedLogicalOperators.All,
                AllowedQueryOptions = AllowedQueryOptions.Filter
                                    | AllowedQueryOptions.OrderBy
                                    | AllowedQueryOptions.Top
                                    | AllowedQueryOptions.SkipToken
                                    | AllowedQueryOptions.Select,
                MaxTop = 1_000,
            };

But following GET request doesn't throw ODataException (it considers filter valid):

http://localhost/testmodel?$filter=cast(value1, 'Int32') in [1,2,3]

while these ones throw exception as expected: http://localhost/testmodel?$filter=cast(value1, 'Int32') eq 3 http://localhost/testmodel?$filter=abs(value1, 'Int32') in [1,2,3]

bullmastiffo avatar Sep 29 '22 13:09 bullmastiffo