MM-23484 - add simple validation to getUserStatusesByIds (#14158)

* MM-23484 - add simple validation to GetUsersStatusesByIds

* MM-23484 - return early in validation, add extra test case

* MM-23484 - add test case for empty array

Co-authored-by: Fedor Vitkovskiy <fedorvitkovskiy@pop-os.localdomain>

api4/status.go

@@ -45,6 +45,13 @@ func getUserStatusesByIds(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	for _, userId := range userIds {
+		if len(userId) != 26 {
+			c.SetInvalidParam("user_ids")
+			return
+		}
+	}
+
 	// No permission check required
 
 	statusMap, err := c.App.GetUserStatusesByIds(userIds)

api4/status_test.go

@@ -58,7 +58,6 @@ func TestGetUserStatus(t *testing.T) {
 
 	t.Run("get status from logged out user", func(t *testing.T) {
 		Client.Logout()
-
 		_, resp := Client.GetUserStatus(th.BasicUser2.Id, "")
 		CheckUnauthorizedStatus(t, resp)
 	})
@@ -83,6 +82,16 @@ func TestGetUsersStatusesByIds(t *testing.T) {
 		CheckBadRequestStatus(t, resp)
 	})
 
+	t.Run("completely invalid userIds list", func(t *testing.T) {
+		_, resp := Client.GetUsersStatusesByIds([]string{"invalid_user_id", "invalid_user_id"})
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("partly invalid userIds list", func(t *testing.T) {
+		_, resp := Client.GetUsersStatusesByIds([]string{th.BasicUser.Id, "invalid_user_id"})
+		CheckBadRequestStatus(t, resp)
+	})
+
 	t.Run("offline status", func(t *testing.T) {
 		usersStatuses, resp := Client.GetUsersStatusesByIds(usersIds)
 		CheckNoError(t, resp)