Skip to content

fix(rest): map invalid history length to InvalidParamsError #715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Zhang-Charlie wants to merge 10 commits into
base: main
Choose a base branch
from
+17 −1
Open

fix(rest): map invalid history length to InvalidParamsError #715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c41100d
fix(rest): map invalid history length to InvalidParamsError
Zhang-Charlie Mar 9, 2026
758f24e
fix(rest): scope historyLength validation handling in getTask
Zhang-Charlie Mar 9, 2026
3ac5f90
fix(cloud-deployment): use Strimzi-supported Kafka version
Zhang-Charlie Mar 9, 2026
ad84170
Revert "fix(cloud-deployment): use Strimzi-supported Kafka version"
Zhang-Charlie Mar 9, 2026
4d7cb1d
Merge branch 'main' into fix/rest-historylength-validation
ehsavoie Mar 9, 2026
91fd77d
Merge branch 'main' into fix/rest-historylength-validation
Zhang-Charlie Mar 9, 2026
c2bbaab
fix(rest): return problem+json for historyLength validation errors
Zhang-Charlie Mar 9, 2026
c330b8c
Merge branch 'main' into fix/rest-historylength-validation
ehsavoie Mar 10, 2026
105345a
fix: throw InvalidParamsError instead of wrapping in problem response
Zhang-Charlie Mar 10, 2026
a32ae7d
refactor(rest): remove duplicate createProblemErrorResponse in RestHa…
Zhang-Charlie Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion transport/rest/src/main/java/io/a2a/transport/rest/handler/RestHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,7 +415,12 @@ public HTTPRestResponse subscribeToTask(ServerCallContext context, String tenant
*/
public HTTPRestResponse getTask(ServerCallContext context, String tenant, String taskId, @Nullable Integer historyLength) {
try {
TaskQueryParams params = new TaskQueryParams(taskId, historyLength, tenant);
TaskQueryParams params;
try {
params = new TaskQueryParams(taskId, historyLength, tenant);
} catch (IllegalArgumentException e) {
throw new InvalidParamsError(e.getMessage());
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The error handling logic introduced here uses InvalidParamsError, which is eventually serialized into a JSON response via the HTTPRestErrorResponse.toJson() method (line 950). This method is vulnerable to JSON injection because it manually constructs a JSON string by concatenating the error message without proper escaping. If an error message contains double quotes, newlines, or other special characters, it will result in malformed JSON or allow an attacker to inject additional fields into the response. It is recommended to use a proper JSON serialization library (like the one already used in createSuccessResponse) to generate the error response.

}
Comment on lines +419 to +423
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

While this correctly handles the exception, using a nested try-catch block adds some visual complexity. For improved readability, consider refactoring this to use a single try block with an additional catch (IllegalArgumentException e) clause. This would flatten the structure and make the error handling logic more straightforward.

Task task = requestHandler.onGetTask(params, context);
if (task != null) {
return createSuccessResponse(200, io.a2a.grpc.Task.newBuilder(ProtoUtils.ToProto.task(task)));
Expand Down
11 changes: 11 additions & 0 deletions transport/rest/src/test/java/io/a2a/transport/rest/handler/RestHandlerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,17 @@ public void testGetTaskNotFound() {
Assertions.assertTrue(response.getBody().contains("TaskNotFoundError"));
}

@Test
public void testGetTaskNegativeHistoryLengthReturns422() {
RestHandler handler = new RestHandler(CARD, requestHandler, internalExecutor);

RestHandler.HTTPRestResponse response = handler.getTask(callContext, "", MINIMAL_TASK.id(), -1);

Assertions.assertEquals(422, response.getStatusCode());
Assertions.assertEquals("application/problem+json", response.getContentType());
Assertions.assertTrue(response.getBody().contains("InvalidParamsError"));
}

@Test
public void testListTasksStatusWireString() {
RestHandler handler = new RestHandler(CARD, requestHandler, internalExecutor);
Expand Down
Loading