Details
-
Bug
-
Status: Open
-
Major
-
Resolution: Unresolved
-
(Java) V4 4.9.0
-
None
-
None
Description
According to the OData specifications ABNF, entity type name and property name (among others) must be constructed according the following rule:
odataIdentifier = identifierLeadingCharacter *127identifierCharacter
identifierLeadingCharacter = ALPHA / "" ; plus Unicode characters from the categories L or Nl_
identifierCharacter = ALPHA / "" / DIGIT ; plus Unicode characters from the categories L, Nl, Nd, Mn, Mc, Pc, or Cf_
However, it is possible to generate an EDM with an entity type name or a property name starting with a digit (e.g.: 1TestType and 1testAttr), which is not compliant with the OData specifications.
Using those types/properties in requests leads to inconsistent results:
- Types:
- Calling entity set with typecast (GET /MyEntitySet/Model.1TestType) results in HTTP 400 "URI is malformed"
- Filtering with isof (GET /MyEntitySet?$filter=isof(Model.1TestType)) results in HTTP 400 "URI is malformed"
- Calling POST /MyEntitySet with @odata.type set to "Model.1TestType" works
- Properties:
- POST /MyEntitySet with "1testAttr" in request body works
- GET /MyEntitySet returns "1testAttr" in the response
- GET /MyEntitySet?$select=1testAttr results in HTTP 400 "URI is malformed"
- GET /MyEntitySet?$filter=1testAttr ne null results in HTTP 400 "The types 'Edm.Boolean' and 'Edm.SByte' are not compatible"
- GET /MyEntitySet?$filter=contains(1testAttr,'Value') results in HTTP 400 "The types 'Edm.SByte' and '[String]' are not compatible."
- GET /MyEntitySet?$orderby=1testAttr results in HTTP 400 "The system query option '$orderby' has the not-allowed value '1testAttr'"
The failed requests are expected, since they validate the OData Identifier in the URI (see UriTokenizer.nextODataIdentifier()).
However, the EDM should not allow such names, and validate the OData identifiers compliance.