fix: artifacts.(*ArtifactServer).GetInputArtifactByUID ensure valid r…

…equest path (#7730)

Signed-off-by: Paco Guzmán <[email protected]>

server/artifacts/artifact_server.go

@@ -96,8 +96,11 @@ func (a *ArtifactServer) GetInputArtifactByUID(w http.ResponseWriter, r *http.Re
 }
 
 func (a *ArtifactServer) getArtifactByUID(w http.ResponseWriter, r *http.Request, isInput bool) {
-	requestPath := strings.SplitN(r.URL.Path, "/", 6)
-
+	requestPath := strings.SplitN(r.URL.Path, "/", 5)
+	if len(requestPath) != 5 {
+		a.serverInternalError(errors.New("request path is not valid"), w)
+		return
+	}
 	uid := requestPath[2]
 	nodeId := requestPath[3]
 	artifactName := requestPath[4]

server/artifacts/artifact_server_test.go

@@ -231,3 +231,20 @@ func TestArtifactServer_GetOutputArtifactByUID(t *testing.T) {
 	s.GetOutputArtifactByUID(w, r)
 	assert.Equal(t, 401, w.StatusCode)
 }
+
+func TestArtifactServer_GetArtifactByUIDInvalidRequestPath(t *testing.T) {
+	s := newServer()
+	r := &http.Request{}
+	// missing my-artifact part to have a valid URL
+	r.URL = mustParse("/input-artifacts/my-uuid/my-node")
+	w := &testhttp.TestResponseWriter{}
+	s.GetInputArtifactByUID(w, r)
+	// make sure there is no index out of bounds error
+	assert.Equal(t, 500, w.StatusCode)
+	assert.Equal(t, "request path is not valid", w.Output)
+
+	w = &testhttp.TestResponseWriter{}
+	s.GetOutputArtifactByUID(w, r)
+	assert.Equal(t, 500, w.StatusCode)
+	assert.Equal(t, "request path is not valid", w.Output)
+}