From be27f22e27b73390724bba9d291c9c76e4006329 Mon Sep 17 00:00:00 2001
From: Igor Kulikov <ikulikov@thingsboard.io>
Date: Tue, 10 Oct 2017 16:04:11 +0300
Subject: [PATCH] Improve validation of request body for Telemetry Rest Calls.

---
 .../handlers/TelemetryRestMsgHandler.java      | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/extensions-core/src/main/java/org/thingsboard/server/extensions/core/plugin/telemetry/handlers/TelemetryRestMsgHandler.java b/extensions-core/src/main/java/org/thingsboard/server/extensions/core/plugin/telemetry/handlers/TelemetryRestMsgHandler.java
index 5b3c59a21b..0d8e6f3694 100644
--- a/extensions-core/src/main/java/org/thingsboard/server/extensions/core/plugin/telemetry/handlers/TelemetryRestMsgHandler.java
+++ b/extensions-core/src/main/java/org/thingsboard/server/extensions/core/plugin/telemetry/handlers/TelemetryRestMsgHandler.java
@@ -16,6 +16,7 @@
 package org.thingsboard.server.extensions.core.plugin.telemetry.handlers;
 
 import com.fasterxml.jackson.databind.JsonNode;
+import com.google.gson.JsonElement;
 import com.google.gson.JsonParser;
 import com.google.gson.JsonSyntaxException;
 import lombok.extern.slf4j.Slf4j;
@@ -214,7 +215,12 @@ public class TelemetryRestMsgHandler extends DefaultRestMsgHandler {
                                           EntityId entityId, String scope) throws ServletException, IOException {
         if (DataConstants.SERVER_SCOPE.equals(scope) ||
                 DataConstants.SHARED_SCOPE.equals(scope)) {
-            JsonNode jsonNode = jsonMapper.readTree(request.getRequestBody());
+            JsonNode jsonNode;
+            try {
+                jsonNode = jsonMapper.readTree(request.getRequestBody());
+            } catch (Exception e) {
+                throw new IllegalArgumentException("Unable to parse attributes payload: Invalid JSON body!");
+            }
             if (jsonNode.isObject()) {
                 List<AttributeKvEntry> attributes = extractRequestAttributes(jsonNode);
                 if (attributes.isEmpty()) {
@@ -264,10 +270,16 @@ public class TelemetryRestMsgHandler extends DefaultRestMsgHandler {
 
     private void handleHttpPostTimeseries(PluginContext ctx, PluginRestMsg msg, RestRequest request, EntityId entityId, long ttl) {
         TelemetryUploadRequest telemetryRequest;
+        JsonElement telemetryJson;
+        try {
+            telemetryJson = new JsonParser().parse(request.getRequestBody());
+        } catch (Exception e) {
+            throw new IllegalArgumentException("Unable to parse timeseries payload: Invalid JSON body!");
+        }
         try {
-            telemetryRequest = JsonConverter.convertToTelemetry(new JsonParser().parse(request.getRequestBody()));
+            telemetryRequest = JsonConverter.convertToTelemetry(telemetryJson);
         } catch (JsonSyntaxException e) {
-            throw new UncheckedApiException(new InvalidParametersException(e.getMessage()));
+            throw new IllegalArgumentException(e.getMessage());
         }
         List<TsKvEntry> entries = new ArrayList<>();
         if (entries.isEmpty()) {