Merge pull request #2270 from bessbd/changes-feed-input-validation

Make changes feed return bad request for invalid heartbeat values

2 files changed, 51 insertions, 1 deletions

diff --git a/src/chttpd/src/chttpd_db.erl b/src/chttpd/src/chttpd_db.erl
index aba1bd22f..970495f0a 100644
--- a/src/chttpd/src/chttpd_db.erl
+++ b/src/chttpd/src/chttpd_db.erl
@@ -1816,7 +1816,14 @@ parse_changes_query(Req) ->
         {"heartbeat", "true"} ->
             Args#changes_args{heartbeat=true};
         {"heartbeat", _} ->
-            Args#changes_args{heartbeat=list_to_integer(Value)};
+            try list_to_integer(Value) of
+                HeartbeatInteger when HeartbeatInteger > 0 ->
+                    Args#changes_args{heartbeat=HeartbeatInteger};
+                _ ->
+                    throw({bad_request, <<"The heartbeat value should be a positive integer (in milliseconds).">>})
+            catch error:badarg ->
+                throw({bad_request, <<"Invalid heartbeat value. Expecting a positive integer value (in milliseconds).">>})
+            end;
         {"timeout", _} ->
             Args#changes_args{timeout=list_to_integer(Value)};
         {"include_docs", "true"} ->
diff --git a/test/elixir/test/changes_test.exs b/test/elixir/test/changes_test.exs
new file mode 100644
index 000000000..b5545087b
--- /dev/null
+++ b/test/elixir/test/changes_test.exs
@@ -0,0 +1,43 @@
+defmodule ChangesTest do
+  use CouchTestCase
+
+  @moduletag :changes
+
+  @moduledoc """
+  Test CouchDB /{db}/_changes
+  """
+
+  @tag :with_db
+  test "Changes feed negative heartbeat", context do
+    db_name = context[:db_name]
+
+    resp = Couch.get(
+      "/#{db_name}/_changes",
+      query: %{
+        :feed => "continuous",
+        :heartbeat => -1000
+      }
+    )
+
+    assert resp.status_code == 400
+    assert resp.body["error"] == "bad_request"
+    assert resp.body["reason"] == "The heartbeat value should be a positive integer (in milliseconds)."
+  end
+
+  @tag :with_db
+  test "Changes feed non-integer heartbeat", context do
+    db_name = context[:db_name]
+
+    resp = Couch.get(
+      "/#{db_name}/_changes",
+      query: %{
+        :feed => "continuous",
+        :heartbeat => "a1000"
+      }
+    )
+
+    assert resp.status_code == 400
+    assert resp.body["error"] == "bad_request"
+    assert resp.body["reason"] == "Invalid heartbeat value. Expecting a positive integer value (in milliseconds)."
+  end
+end