From a29f6833bb82476641d54af959fe599f92531b1f Mon Sep 17 00:00:00 2001
From: David Roberts <David.Roberts@orbis.com>
Date: Mon, 12 Feb 2024 16:31:36 +0000
Subject: [PATCH] explicit rejection of bad parameter types

Signed-off-by: David Roberts <David.Roberts@orbis.com>
---
 .../azure-devops-backend/src/service/router.test.ts | 10 ++++++++++
 plugins/azure-devops-backend/src/service/router.ts  | 13 ++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/plugins/azure-devops-backend/src/service/router.test.ts b/plugins/azure-devops-backend/src/service/router.test.ts
index 8793860708..7bf558612f 100644
--- a/plugins/azure-devops-backend/src/service/router.test.ts
+++ b/plugins/azure-devops-backend/src/service/router.test.ts
@@ -562,6 +562,16 @@ describe('createRouter', () => {
       });
     });
   });
+
+  describe('GET /readme/:projectName/:repoName with a bad readme path (multiple values)', () => {
+    it('throws InputError', async () => {
+      const response = await request(app).get(
+        '/readme/myProject/myRepo?path=1&path=2',
+      );
+      expect(azureDevOpsApi.getReadme).not.toHaveBeenCalled();
+      expect(response.status).toEqual(400);
+    });
+  });
 });
 
 function getReadmeMock() {
diff --git a/plugins/azure-devops-backend/src/service/router.ts b/plugins/azure-devops-backend/src/service/router.ts
index a00b0ce910..230ff08c8b 100644
--- a/plugins/azure-devops-backend/src/service/router.ts
+++ b/plugins/azure-devops-backend/src/service/router.ts
@@ -26,6 +26,7 @@ import { Logger } from 'winston';
 import { PullRequestsDashboardProvider } from '../api/PullRequestsDashboardProvider';
 import Router from 'express-promise-router';
 import { errorHandler, UrlReader } from '@backstage/backend-common';
+import { InputError } from '@backstage/errors';
 import express from 'express';
 
 const DEFAULT_TOP = 10;
@@ -216,7 +217,17 @@ export async function createRouter(
       req.query.host?.toString() ?? config.getString('azureDevOps.host');
     const org =
       req.query.org?.toString() ?? config.getString('azureDevOps.organization');
-    const path = req.query.path?.toString() ?? 'README.md';
+    let path = req.query.path;
+
+    if (path === undefined) {
+      // if the annotation is missing, default to the previous behaviour (look for README.md in the root of the repo)
+      path = 'README.md';
+    }
+
+    if (typeof path !== 'string') {
+      throw new InputError('Invalid path param');
+    }
+
     const { projectName, repoName } = req.params;
     const readme = await azureDevOpsApi.getReadme(
       host,