From d3d852b25de58857516f431bd13d6c87dbc1ad65 Mon Sep 17 00:00:00 2001 From: Fabio Bonelli Date: Tue, 10 Nov 2026 03:44:38 +0000 Subject: [PATCH] fix: reject malformed merge patches --- internal/common/patch.go | 2 +- internal/common/patch_test.go | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/internal/common/patch.go b/internal/common/patch.go index 508cc7b..e2f561d 100644 --- a/internal/common/patch.go +++ b/internal/common/patch.go @@ -59,7 +59,7 @@ func ApplyPatch[T any](entity *T, contentType string, body []byte) (T, *PatchErr } else { updatedJSON, err = jsonpatch.MergePatch(entityJSON, body) if err != nil { - return zero, &PatchError{Code: http.StatusInternalServerError, Err: err} + return zero, &PatchError{Code: http.StatusBadRequest, Err: err} } } diff --git a/internal/common/patch_test.go b/internal/common/patch_test.go index 9738a6b..6a4d216 100644 --- a/internal/common/patch_test.go +++ b/internal/common/patch_test.go @@ -47,3 +47,11 @@ func TestApplyPatchJSONPatchValidation(t *testing.T) { assert.Nil(t, err) }) } + +func TestApplyPatchRejectsMalformedMergePatch(t *testing.T) { + entity := sampleEntity() + + _, err := common.ApplyPatch(&entity, "application/merge-patch+json", []byte(`{"name":`)) + + assert.Equal(t, 400, err.Code) +}