Check that required query params are non-zero

code-asher · code-asher · commit 139f004daddb · 2024-01-23T16:10:50.000-09:00
diff --git a/coderd/httpapi/queryparams.go b/coderd/httpapi/queryparams.go
@@ -246,7 +246,7 @@ func ParseCustomList[T any](parser *QueryParamParser, vals url.Values, def []T,
 func parseQueryParam[T any](parser *QueryParamParser, vals url.Values, parse func(v string) (T, error), def T, queryParam string) (T, error) {
 	parser.addParsed(queryParam)
 	// If the query param is required and not present, return an error.
-	if parser.RequiredParams[queryParam] && (!vals.Has(queryParam)) {
+	if parser.RequiredParams[queryParam] && (!vals.Has(queryParam) || vals.Get(queryParam) == "") {
 		parser.Errors = append(parser.Errors, codersdk.ValidationError{
 			Field:  queryParam,
 			Detail: fmt.Sprintf("Query param %q is required", queryParam),
diff --git a/coderd/httpapi/queryparams_test.go b/coderd/httpapi/queryparams_test.go
@@ -323,6 +323,11 @@ func TestParseQueryParams(t *testing.T) {
 		parser.Required("test_value")
 		parser.UUID(url.Values{}, uuid.New(), "test_value")
 		require.Len(t, parser.Errors, 1)
+
+		parser = httpapi.NewQueryParamParser()
+		parser.Required("test_value")
+		parser.String(url.Values{"test_value": {""}}, "", "test_value")
+		require.Len(t, parser.Errors, 1)
 	})
 }
 
