Skip to content

backport: fix: reject invalid/negative lastUpdatedDuration on dataValueSets export instead of silently ignoring it - #24683

Open
jason-p-pickering wants to merge 1 commit into
2.43from
fix/invalid-duration-dvs-43_2.43
Open

backport: fix: reject invalid/negative lastUpdatedDuration on dataValueSets export instead of silently ignoring it#24683
jason-p-pickering wants to merge 1 commit into
2.43from
fix/invalid-duration-dvs-43_2.43

Conversation

@jason-p-pickering

Copy link
Copy Markdown
Contributor

…ort instead of silently ignoring it (#24470)

* fix: reject invalid/negative lastUpdatedDuration on dataValueSets export instead of silently ignoring it

DateUtils.getDuration() returns null on any parse failure (its regex requires
unsigned digits, so negative durations like "-5d" never match), and
DefaultDataExportService.decodeParams() called it unchecked, so a malformed or
negative lastUpdatedDuration was silently discarded - indistinguishable from
"not provided". If it was the client's only time filter, this surfaced as the
unrelated E2002 error instead of pointing at the actual problem; otherwise it
was dropped with no error at all.

ErrorCode.E2005 ("Duration is not valid: `{0}`") already exists for exactly
this and is used by the sibling DefaultCompleteDataSetRegistrationExchangeService
for its createdDuration parameter, but was never wired up here.

decodeParams() now throws ConflictException(E2005, rawValue) when
lastUpdatedDuration is non-blank but fails to parse. lastUpdatedDuration=0d
is deliberately left valid - it parses successfully (Duration.ZERO) and is a
well-defined (if narrow) "as of right now" filter, analogous to
startDate == endDate being a valid zero-width date range.

Verified via mutation testing: temporarily disabled the new guard, confirmed
only the two negative-case tests failed (the 0d-is-valid test stayed green),
then restored. No regressions in DataExportServiceExportTest,
DataValueServiceTest, or DataValueSetControllerTest.

Related to DHIS2-21821.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix: reduce decodeParams cognitive complexity and cover blank duration branch

Extracts attribute-option-combo, order, and lastUpdatedDuration resolution
into their own methods so decodeParams stays under the complexity limit,
and adds a test for the blank (non-null) lastUpdatedDuration case that the
isBlank() guard exists to handle.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant