From 7612888052132949665d948c0fc4a2af8f77ef6a Mon Sep 17 00:00:00 2001
From: Claudio Costa <cstcld91@gmail.com>
Date: Tue, 8 Sep 2020 20:36:59 +0200
Subject: [PATCH] Fix panic in api4.searchPosts (#15410)

---
 api4/post.go       |  6 +++++-
 i18n/en.json       |  4 ++++
 model/post.go      |  9 ++++-----
 model/post_test.go | 28 ++++++++++++++++++++++++++++
 4 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/api4/post.go b/api4/post.go
index 5aaf8f9f7f..d9cd14a858 100644
--- a/api4/post.go
+++ b/api4/post.go
@@ -466,7 +466,11 @@ func searchPosts(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	params := model.SearchParameterFromJson(r.Body)
+	params, jsonErr := model.SearchParameterFromJson(r.Body)
+	if jsonErr != nil {
+		c.Err = model.NewAppError("searchPosts", "api.post.search_posts.invalid_body.app_error", nil, jsonErr.Error(), http.StatusBadRequest)
+		return
+	}
 
 	if params.Terms == nil || len(*params.Terms) == 0 {
 		c.SetInvalidParam("terms")
diff --git a/i18n/en.json b/i18n/en.json
index cafd1aaa59..cdf211d921 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -1790,6 +1790,10 @@
     "id": "api.post.save_is_pinned_post.town_square_read_only",
     "translation": "This channel is read-only. Only members with permission can pin or unpin posts here."
   },
+  {
+    "id": "api.post.search_posts.invalid_body.app_error",
+    "translation": "Unable to parse the request body."
+  },
   {
     "id": "api.post.send_notification_and_forget.push_channel_mention",
     "translation": " notified the channel."
diff --git a/model/post.go b/model/post.go
index 7c27eca9b6..6e29ba3e36 100644
--- a/model/post.go
+++ b/model/post.go
@@ -497,15 +497,14 @@ func (o *SearchParameter) SearchParameterToJson() string {
 	return string(b)
 }
 
-func SearchParameterFromJson(data io.Reader) *SearchParameter {
+func SearchParameterFromJson(data io.Reader) (*SearchParameter, error) {
 	decoder := json.NewDecoder(data)
 	var searchParam SearchParameter
-	err := decoder.Decode(&searchParam)
-	if err != nil {
-		return nil
+	if err := decoder.Decode(&searchParam); err != nil {
+		return nil, err
 	}
 
-	return &searchParam
+	return &searchParam, nil
 }
 
 func (o *Post) ChannelMentions() []string {
diff --git a/model/post_test.go b/model/post_test.go
index 0c38389246..d1a94a27d4 100644
--- a/model/post_test.go
+++ b/model/post_test.go
@@ -856,3 +856,31 @@ func TestPostPatchDisableMentionHighlights(t *testing.T) {
 		assert.Nil(t, patch.Message)
 	})
 }
+
+func TestSearchParameterFromJson(t *testing.T) {
+	t.Run("empty input", func(t *testing.T) {
+		params, err := SearchParameterFromJson(strings.NewReader(""))
+		require.Nil(t, params)
+		require.Error(t, err)
+	})
+
+	t.Run("invalid json", func(t *testing.T) {
+		params, err := SearchParameterFromJson(strings.NewReader("invalid"))
+		require.Nil(t, params)
+		require.Error(t, err)
+	})
+
+	t.Run("valid empty input", func(t *testing.T) {
+		params, err := SearchParameterFromJson(strings.NewReader("{}"))
+		require.NoError(t, err)
+		require.NotNil(t, params)
+		require.Equal(t, &SearchParameter{}, params)
+	})
+
+	t.Run("valid non-empty input", func(t *testing.T) {
+		params, err := SearchParameterFromJson(strings.NewReader("{\"terms\": \"test\"}"))
+		require.NoError(t, err)
+		require.NotNil(t, params)
+		require.Equal(t, "test", *params.Terms)
+	})
+}