modelId should be numeric

rest-api/src/main/java/lcsb/mapviewer/api/BaseRestImpl.java

@@ -8,6 +8,7 @@ import javax.xml.transform.*;
 import javax.xml.transform.stream.StreamResult;
 import javax.xml.transform.stream.StreamSource;
 
+import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.math.NumberUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -160,10 +161,9 @@ public abstract class BaseRestImpl {
    * @param modelId
    *          list of model identifiers separated by "," or '*' when all models
    *          should be returned
-   * @throws ObjectNotFoundException
-   *           thrown when data for given identifiers doesn't exist
+   * @throws QueryException 
    */
-  protected List<Model> getModels(String projectId, String modelId) throws ObjectNotFoundException {
+  protected List<Model> getModels(String projectId, String modelId) throws QueryException {
     Model model = modelService.getLastModelByProjectId(projectId);
     if (model == null) {
       throw new ObjectNotFoundException("Project with given id doesn't exist");
@@ -172,6 +172,10 @@ public abstract class BaseRestImpl {
 
     if (!modelId.equals("*")) {
       for (String str : modelId.split(",")) {
+        if (!StringUtils.isNumeric(str)) {
+          throw new QueryException("Invalid modelId: " + modelId);
+        }
+
         Model submodel = model.getSubmodelById(Integer.valueOf(str));
         if (submodel == null) {
           throw new ObjectNotFoundException("Model with given id doesn't exist");

rest-api/src/main/java/lcsb/mapviewer/api/projects/ProjectController.java

@@ -114,7 +114,7 @@ public class ProjectController extends BaseController {
 
   @PreAuthorize("hasAnyAuthority('IS_ADMIN', 'READ_PROJECT:' + #projectId)")
   @GetMapping(value = "/{projectId}/statistics")
-  public Object getStatistics(@PathVariable(value = "projectId") String projectId) throws ObjectNotFoundException {
+  public Object getStatistics(@PathVariable(value = "projectId") String projectId) throws QueryException {
     return projectController.getStatistics(projectId);
   }
 

rest-api/src/main/java/lcsb/mapviewer/api/projects/ProjectRestImpl.java

@@ -195,7 +195,7 @@ public class ProjectRestImpl extends BaseRestImpl {
     return project.getInputData();
   }
 
-  public Map<String, Object> getStatistics(String projectId) throws ObjectNotFoundException {
+  public Map<String, Object> getStatistics(String projectId) throws QueryException {
     Map<String, Object> result = new TreeMap<>();
 
     Map<MiriamType, Integer> elementAnnotations = new TreeMap<>();
@@ -624,7 +624,7 @@ public class ProjectRestImpl extends BaseRestImpl {
     return null;
   }
 
-  public List<Map<String, Object>> getSubmapConnections(String projectId) throws ObjectNotFoundException {
+  public List<Map<String, Object>> getSubmapConnections(String projectId) throws QueryException {
     List<Map<String, Object>> result = new ArrayList<>();
     List<Model> models = getModels(projectId, "*");
     List<Element> elements = new ArrayList<>();

rest-api/src/main/java/lcsb/mapviewer/api/projects/models/ModelController.java

@@ -4,6 +4,7 @@ import java.io.IOException;
 import java.util.List;
 import java.util.Map;
 
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -37,7 +38,7 @@ public class ModelController extends BaseController {
   @PreAuthorize("hasAnyAuthority('IS_ADMIN', 'READ_PROJECT:' + #projectId)")
   @GetMapping(value = "/")
   public List<Map<String, Object>> getModels(@PathVariable(value = "projectId") String projectId)
-      throws ObjectNotFoundException {
+      throws QueryException {
     return modelController.getModels(projectId);
   }
 
@@ -45,7 +46,7 @@ public class ModelController extends BaseController {
   @GetMapping(value = "/{modelId:.+}")
   public Object getModel(
       @PathVariable(value = "modelId") String modelId,
-      @PathVariable(value = "projectId") String projectId) throws ObjectNotFoundException {
+      @PathVariable(value = "projectId") String projectId) throws QueryException {
     if (modelId.equals("*")) {
       return modelController.getModels(projectId);
     } else {

rest-api/src/main/java/lcsb/mapviewer/api/projects/models/ModelRestImpl.java

 package lcsb.mapviewer.api.projects.models;
 
-import java.awt.*;
+import java.awt.Color;
 import java.awt.geom.*;
 import java.io.*;
 import java.util.*;
-import java.util.List;
 
 import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -59,7 +59,7 @@ public class ModelRestImpl extends BaseRestImpl {
     this.layoutService = layoutService;
   }
 
-  public List<Map<String, Object>> getModels(String projectId) throws ObjectNotFoundException {
+  public List<Map<String, Object>> getModels(String projectId) throws QueryException {
     Project project = getProjectService().getProjectByProjectId(projectId);
     if (project == null) {
       throw new ObjectNotFoundException("Project with given id doesn't exist");
@@ -67,7 +67,10 @@ public class ModelRestImpl extends BaseRestImpl {
     return createData(project);
   }
 
-  public Map<String, Object> getModel(String projectId, String modelId) {
+  public Map<String, Object> getModel(String projectId, String modelId) throws QueryException {
+    if (!StringUtils.isNumeric(modelId)) {
+      throw new QueryException("Invalid modelId: " + modelId);
+    }
     Model model = getModelService().getLastModelByProjectId(projectId);
     Model submodel = model.getSubmodelById(modelId);
     if (submodel == null) {
@@ -95,7 +98,7 @@ public class ModelRestImpl extends BaseRestImpl {
     }
   }
 
-  private List<Map<String, Object>> createData(Project project) {
+  private List<Map<String, Object>> createData(Project project) throws QueryException {
     List<Map<String, Object>> result = new ArrayList<>();
     Model model = getModelService().getLastModelByProjectId(project.getProjectId());
     if (model != null) {

rest-api/src/main/java/lcsb/mapviewer/api/projects/models/parameters/ParametersRestImpl.java

@@ -36,7 +36,7 @@ public class ParametersRestImpl extends BaseRestImpl {
   }
 
   private Set<SbmlParameter> getParametersFromProject(String projectId, String modelId)
-      throws ObjectNotFoundException {
+      throws QueryException {
     List<Model> models = getModels(projectId, modelId);
     Set<SbmlParameter> parameters = new LinkedHashSet<>();
 
@@ -52,7 +52,7 @@ public class ParametersRestImpl extends BaseRestImpl {
   }
 
   private Set<SbmlParameter> getGlobalParametersFromProject(String projectId, String modelId)
-      throws ObjectNotFoundException {
+      throws QueryException {
     List<Model> models = getModels(projectId, modelId);
     Set<SbmlParameter> parameters = new LinkedHashSet<>();
 

rest-api/src/main/java/lcsb/mapviewer/api/projects/models/units/UnitsRestImpl.java

@@ -59,7 +59,7 @@ public class UnitsRestImpl extends BaseRestImpl {
     return result;
   }
 
-  public List<Map<String, Object>> getUnits(String projectId, String modelId) throws ObjectNotFoundException {
+  public List<Map<String, Object>> getUnits(String projectId, String modelId) throws QueryException {
     List<Map<String, Object>> result = new ArrayList<>();
     List<Model> models = getModels(projectId, modelId);
     for (Model model : models) {