diff --git a/CHANGELOG.md b/CHANGELOG.md index 4499d432d..ec4e3f5cd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -42,6 +42,7 @@ SPDX-License-Identifier: GPL-3.0-or-later - irc: display a warning for each unknown or invalid server option in commands /connect and /server - relay/api: fix crash when an invalid HTTP request is received from a client - relay/api: return HTTP error 404 instead of 400 when the buffer is not found in resources completion and input +- relay/api: return HTTP error 400 in case of invalid body in resource ping ## Version 4.7.1 (2025-08-16) diff --git a/src/plugins/relay/api/relay-api-protocol.c b/src/plugins/relay/api/relay-api-protocol.c index 4e318a33a..fbc8da059 100644 --- a/src/plugins/relay/api/relay-api-protocol.c +++ b/src/plugins/relay/api/relay-api-protocol.c @@ -1000,12 +1000,11 @@ RELAY_API_PROTOCOL_CALLBACK(completion) return RELAY_API_PROTOCOL_RC_MEMORY; } - if (!weechat_completion_search (ptr_completion, ptr_command, position, 1)) - { - weechat_completion_free (ptr_completion); - cJSON_Delete (json_body); - return RELAY_API_PROTOCOL_RC_BAD_REQUEST; - } + /* + * ignore the return code, as 0 may indicate that completion "null" was used + * (that means no completion context found) + */ + (void) weechat_completion_search (ptr_completion, ptr_command, position, 1); /* create response */ json_response = relay_api_msg_completion_to_json (ptr_completion); @@ -1035,6 +1034,11 @@ RELAY_API_PROTOCOL_CALLBACK(ping) json_body = cJSON_Parse (client->http_req->body); if (json_body) { + if (!cJSON_IsObject (json_body)) + { + cJSON_Delete (json_body); + return RELAY_API_PROTOCOL_RC_BAD_REQUEST; + } json_data = cJSON_GetObjectItem (json_body, "data"); if (json_data && cJSON_IsString (json_data)) ptr_data = cJSON_GetStringValue (json_data); diff --git a/src/plugins/relay/api/weechat-relay-api.yaml b/src/plugins/relay/api/weechat-relay-api.yaml index cb15c671f..2c2f598dc 100644 --- a/src/plugins/relay/api/weechat-relay-api.yaml +++ b/src/plugins/relay/api/weechat-relay-api.yaml @@ -720,6 +720,12 @@ paths: $ref: '#/components/schemas/Ping' '204': description: Successful operation + '400': + description: Bad request + content: + application/json: + schema: + $ref: '#/components/schemas/Error' '401': description: Unauthorized content: