Make changes feed return bad request for invalid heartbeat values

Using a negative heartbeat value does not return a 400 bad request, instead getting just an empty response with no status code at all.

This commit adds extra checks so that negative and non-integer heartbeat values return 400 bad request responses.

This fixes #2234

2 files changed, 51 insertions, 1 deletions

diff --git a/src/chttpd/src/chttpd_db.erl b/src/chttpd/src/chttpd_db.erl
index aba1bd22f..970495f0a 100644
--- a/src/chttpd/src/chttpd_db.erl
+++ b/src/chttpd/src/chttpd_db.erl
@@ -1816,7 +1816,14 @@ parse_changes_query(Req) ->
         {"heartbeat", "true"} ->
             Args#changes_args{heartbeat=true};
         {"heartbeat", _} ->
-            Args#changes_args{heartbeat=list_to_integer(Value)};
+            try list_to_integer(Value) of
+                HeartbeatInteger when HeartbeatInteger > 0 ->
+                    Args#changes_args{heartbeat=HeartbeatInteger};
+                _ ->
+                    throw({bad_request, <<"The heartbeat value should be a positive integer (in milliseconds).">>})
+            catch error:badarg ->
+                throw({bad_request, <<"Invalid heartbeat value. Expecting a positive integer value (in milliseconds).">>})
+            end;
         {"timeout", _} ->
             Args#changes_args{timeout=list_to_integer(Value)};
         {"include_docs", "true"} ->
diff --git a/test/elixir/test/changes_test.exs b/test/elixir/test/changes_test.exs
new file mode 100644
index 000000000..b5545087b
--- /dev/null
+++ b/test/elixir/test/changes_test.exs
@@ -0,0 +1,43 @@
+defmodule ChangesTest do
+  use CouchTestCase
+
+  @moduletag :changes
+
+  @moduledoc """
+  Test CouchDB /{db}/_changes
+  """
+
+  @tag :with_db
+  test "Changes feed negative heartbeat", context do
+    db_name = context[:db_name]
+
+    resp = Couch.get(
+      "/#{db_name}/_changes",
+      query: %{
+        :feed => "continuous",
+        :heartbeat => -1000
+      }
+    )
+
+    assert resp.status_code == 400
+    assert resp.body["error"] == "bad_request"
+    assert resp.body["reason"] == "The heartbeat value should be a positive integer (in milliseconds)."
+  end
+
+  @tag :with_db
+  test "Changes feed non-integer heartbeat", context do
+    db_name = context[:db_name]
+
+    resp = Couch.get(
+      "/#{db_name}/_changes",
+      query: %{
+        :feed => "continuous",
+        :heartbeat => "a1000"
+      }
+    )
+
+    assert resp.status_code == 400
+    assert resp.body["error"] == "bad_request"
+    assert resp.body["reason"] == "Invalid heartbeat value. Expecting a positive integer value (in milliseconds)."
+  end
+end