Assemblies affected
ASP.NET Core OData 9.5.0
Describe the bug
Our project is structured like the ODataDynamicModel Sample from this repository which creates a dynamic route like this: [ref] options.Value.AddRouteComponents("/execution/{executionId}", EdmCoreModel.Instance);
On top of this dynamic model architecture we implemented the $batch functionality which I believe stopped working after updating from 9.4.1 to 9.5.0 due to the "Strengthen OData batch sub-request URL and header validation." part of the release.
After upgrading we get the following error message on our batch requests:
Error:The batch sub-request URI 'https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)' targets a path that is not within the OData service root 'https://[host]/execution/{executionId}.
Reproduce steps
Start from the ODataDynamicModel sample, add odata batch and execute a batch request.
Data Model
Our data model is completely dynamic since it's defined by the application user.
It should be irrelevant since the request is failing before reaching any data model logic.
EDM (CSDL) Model
Irrelevant for the issue.
Request/Response
Request uri: https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)
Request body:
{
"requests": [
{
"id": "1",
"method": "GET",
"url": "/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)"
}
]
}
Response:
{
"message": "Error:The batch sub-request URI 'https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)' targets a path that is not within the OData service root 'https://[host]/execution/{executionId}'. Batch sub-requests must address resources within the OData service.",
"code": 500
}
Expected behavior
I would expect that the new security validation applied to batch sub-requests was capable of handling wildcards required for dynamic models on top of the currently applied checks.
Assemblies affected
ASP.NET Core OData 9.5.0
Describe the bug
Our project is structured like the ODataDynamicModel Sample from this repository which creates a dynamic route like this: [ref] options.Value.AddRouteComponents("/execution/{executionId}", EdmCoreModel.Instance);
On top of this dynamic model architecture we implemented the $batch functionality which I believe stopped working after updating from 9.4.1 to 9.5.0 due to the "Strengthen OData batch sub-request URL and header validation." part of the release.
After upgrading we get the following error message on our batch requests:
Error:The batch sub-request URI 'https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)' targets a path that is not within the OData service root 'https://[host]/execution/{executionId}.
Reproduce steps
Start from the ODataDynamicModel sample, add odata batch and execute a batch request.
Data Model
Our data model is completely dynamic since it's defined by the application user.
It should be irrelevant since the request is failing before reaching any data model logic.
EDM (CSDL) Model
Irrelevant for the issue.
Request/Response
Request uri: https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)
Request body:
{
"requests": [
{
"id": "1",
"method": "GET",
"url": "/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)"
}
]
}
Response:
{
"message": "Error:The batch sub-request URI 'https://[host]/execution/04cabae6d5754fc89a3f91010266ba0b/Orders(1)' targets a path that is not within the OData service root 'https://[host]/execution/{executionId}'. Batch sub-requests must address resources within the OData service.",
"code": 500
}
Expected behavior
I would expect that the new security validation applied to batch sub-requests was capable of handling wildcards required for dynamic models on top of the currently applied checks.