harden repository adapters against empty calls

prevent requested ids from being empty or null.
crnk-project · Nov 6, 2019 · 1fa9e05 · 1fa9e05
1 parent becce14
commit 1fa9e05
Show file tree

Hide file tree

Showing 4 changed files with 249 additions and 243 deletions.
diff --git a/.../src/main/java/io/crnk/core/engine/internal/repository/ResourceRepositoryAdapterImpl.java b/.../src/main/java/io/crnk/core/engine/internal/repository/ResourceRepositoryAdapterImpl.java
@@ -10,6 +10,7 @@
 import io.crnk.core.engine.http.HttpMethod;
 import io.crnk.core.engine.information.repository.ResourceRepositoryInformation;
 import io.crnk.core.engine.information.resource.ResourceInformation;
+import io.crnk.core.engine.internal.utils.PreconditionUtil;
 import io.crnk.core.engine.internal.utils.ResourceUtils;
 import io.crnk.core.engine.query.QueryAdapter;
 import io.crnk.core.engine.result.ImmediateResult;
@@ -108,6 +109,7 @@ protected JsonApiResponse invoke(RepositoryFilterContext context) {
 
 	@Override
 	public Result<JsonApiResponse> findAll(Collection ids, QueryAdapter queryAdapter) {
+		PreconditionUtil.verify(!ids.isEmpty(), "empty set of IDs passed as argument");
 		ids = ResourceUtils.toTypedIds(resourceInformation, ids);
 		if (!resourceInformation.getAccess().isReadable()) {
 			throw new MethodNotAllowedException(HttpMethod.GET.toString());

diff --git a/crnk-core/src/main/java/io/crnk/core/repository/foward/strategy/GetFromOwnerStrategy.java b/crnk-core/src/main/java/io/crnk/core/repository/foward/strategy/GetFromOwnerStrategy.java
@@ -40,25 +40,26 @@ public MultivaluedMap<I, D> findTargets(Collection<I> sourceIds, String fieldNam
 			Set targetIds = new HashSet();
 			for (Object source : sources) {
 				Object targetId = field.getIdAccessor().getValue(source);
+				if(targetId == null){
+					continue; // null relationship
+				}
 				if (field.isCollection()) {
 					targetIds.addAll((Collection) targetId);
 				} else {
 					targetIds.add(targetId);
 				}
 			}
 
-			ResourceRepositoryAdapter targetAdapter = targetEntry.getResourceRepository();
-			JsonApiResponse response = targetAdapter.findAll(targetIds, context.createQueryAdapter(querySpec, queryContext)).get();
-			targets = (List<D>) response.getEntity();
-			return toResult(field, targetInformation, sources, targets);
+			if(!targetIds.isEmpty()) {
+				ResourceRepositoryAdapter targetAdapter = targetEntry.getResourceRepository();
+				JsonApiResponse response = targetAdapter.findAll(targetIds, context.createQueryAdapter(querySpec, queryContext)).get();
+				targets = (List<D>) response.getEntity();
+				return toResult(field, targetInformation, sources, targets);
+			}else{
+				return newResultMap();
+			}
 		} else {
-			MultivaluedMap bulkResult = new MultivaluedMap<I, D>() {
-
-				@Override
-				protected List<D> newList() {
-					return new DefaultResourceList<>();
-				}
-			};
+			MultivaluedMap bulkResult = newResultMap();
 			for (Object source : sources) {
 				Object sourceId = sourceInformation.getId(source);
 
@@ -75,18 +76,21 @@ protected List<D> newList() {
 		}
 	}
 
-	private MultivaluedMap<I, D> toResult(ResourceField field, ResourceInformation targetInformation,
-			List sources,
-			List<D> targets) {
-
-		MultivaluedMap bulkResult = new MultivaluedMap<I, D>() {
+	private MultivaluedMap newResultMap() {
+		return new MultivaluedMap<I, D>() {
 
 			@Override
 			protected List<D> newList() {
 				return new DefaultResourceList<>();
 			}
 		};
+	}
+
+	private MultivaluedMap<I, D> toResult(ResourceField field, ResourceInformation targetInformation,
+			List sources,
+			List<D> targets) {
 
+		MultivaluedMap bulkResult = newResultMap();
 		Map targetMap = new HashMap();
 		for (D target : targets) {
 			Object targetId = targetInformation.getId(target);