RESTServer is returning HTML in header error messages generated by RESTServer::handleException [#1966942]

The HTTP header error messages returned on a REST request contain HTML; these tags should be stripped from the header message before the response is returned.

One potential fix: Replace RESTServer.inc, line 796:
drupal_add_http_header('Status', $error_header_status_message);
with this:
drupal_add_http_header('Status', strip_tags($error_header_status_message));

Comment	File	Size	Author
#3	services-1966942-strip-tags-error-message-status.patch	594 bytes	ygerasimov

Comments

Comment #1

ygerasimov commented 10 April 2013 at 19:00

@lhridley can you advise when you get HTML in your error message? How I can reproduce this problem?

Comment #2

lisa.rae commented 10 April 2013 at 19:15

Sure. I've got a RESTful server accepting JSON set up, and when I submit a request to register an account that is a duplicate name or email, I get HTML returned. For example, a request as follows:

Content-Type: application/json
Method: POST
Endpoint: /user/register.json
Body:

{
"name":"lhridley",
"mail":"lhridey@roveworks.com",
"pass":"mypassword"
}

Returns the following header response:


Status Code: 406 Not Acceptable: The name <em class="placeholder">lhridley</em> is already taken. The e-mail address <em class="placeholder">lhridey@roveworks.com</em> is already taken.

This is just one example. Basically any error that is normally returned in drupal_set_message() that has HTML that we are instead returning in the Status Code header needs to have the HTML tags stripped before they are returned.