Skip to content

Fix #1055: Do not throw when ODataQueryOptions constructor receives whitespace query param keys#1540

Open
axnetg wants to merge 2 commits intoOData:mainfrom
axnetg:whitespace-queryparam-fix
Open

Fix #1055: Do not throw when ODataQueryOptions constructor receives whitespace query param keys#1540
axnetg wants to merge 2 commits intoOData:mainfrom
axnetg:whitespace-queryparam-fix

Conversation

@axnetg
Copy link

@axnetg axnetg commented Nov 12, 2025

Fixes #1055.

When EnableNoDollarQueryOptions is set to true and an OData endpoint receives a query string containing empty or whitespace-only keys, the ODataQueryOptions constructor would throw an exception. This happened because, with this option enabled, the code attempted to process all keys using the IsSupportedQueryOption method, which throws on empty input. When EnableNoDollarQueryOptions is false, the logic only processed keys starting with '$', so empty strings were immediately discarded and did not cause an exception.

This PR updates the query string parsing logic to ignore any query string keys that are empty. This ensures that only valid keys are processed as query options. The fix is backward-compatible and does not affect the handling of valid query options.

Let me know if you need further adjustments!

@axnetg
Copy link
Author

axnetg commented Nov 12, 2025

@microsoft-github-policy-service agree

else
{
if (IsSupportedQueryOption(key))
if (!string.IsNullOrEmpty(key) && IsSupportedQueryOption(key))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it acceptable for the OData endpoint to allow an empty or whitespace-only query option, such as:
GET http://server/service/Customers?%20

Throwing an exception in this case seems reasonable.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @WanjohiSammy. I think avoiding the throw is the right choice here, since this is something a client can trigger and it currently results in an internal server error in the controller action, which doesn’t feel appropriate. This also makes the behavior consistent with EnableNoDollarQueryOptions = false, where unknown or empty keys are already ignored.

WanjohiSammy
WanjohiSammy previously approved these changes Dec 4, 2025
Copy link
Member

@WanjohiSammy WanjohiSammy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@axnetg Please add an E2E test for this scenario. You can update the existing TestOrderBy_WithDifferentPropertyCase or any other tests by including cases like:

...
[InlineData("/books?orderby=ISBN&top=1&%20=foo&%20=%20")]
...
public async Task TestOrderBy_WithDifferentPropertyCase(string requestUri)
{
   ...
}

@axnetg
Copy link
Author

axnetg commented Dec 4, 2025

@WanjohiSammy Done!
I added some tests as a separate class to avoid cluttering existing ones with strange cases. It mimics the structure of CaseInsensitiveTest.cs. Let me know if you prefer a different location for this type of test.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ODataQueryOptions binding throws an ArgumentException with a whitespace query param

2 participants