From b443746e80f706eef2c423b87d8c0fbd13681ff7 Mon Sep 17 00:00:00 2001
From: Agniva De Sarker <agnivade@yahoo.co.in>
Date: Sat, 11 Jun 2022 00:24:04 +0530
Subject: [PATCH] MM-44805: Avoid pointers in JSON parsing in
 createCategoryForTeamForUser (#20429)

Passing null is a valid JSON input for a pointer struct. So we avoid
passing pointer to pointer.

https://mattermost.atlassian.net/browse/MM-44805

```release-note
NONE
```
---
 api4/channel_category.go      |  6 +++---
 api4/channel_category_test.go | 12 ++++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/api4/channel_category.go b/api4/channel_category.go
index e14a0f13cb..b9bf68009b 100644
--- a/api4/channel_category.go
+++ b/api4/channel_category.go
@@ -52,19 +52,19 @@ func createCategoryForTeamForUser(c *Context, w http.ResponseWriter, r *http.Req
 	auditRec := c.MakeAuditRecord("createCategoryForTeamForUser", audit.Fail)
 	defer c.LogAuditRec(auditRec)
 
-	var categoryCreateRequest *model.SidebarCategoryWithChannels
+	var categoryCreateRequest model.SidebarCategoryWithChannels
 	err := json.NewDecoder(r.Body).Decode(&categoryCreateRequest)
 	if err != nil || c.Params.UserId != categoryCreateRequest.UserId || c.Params.TeamId != categoryCreateRequest.TeamId {
 		c.SetInvalidParam("category")
 		return
 	}
 
-	if appErr := validateSidebarCategory(c, c.Params.TeamId, c.Params.UserId, categoryCreateRequest); appErr != nil {
+	if appErr := validateSidebarCategory(c, c.Params.TeamId, c.Params.UserId, &categoryCreateRequest); appErr != nil {
 		c.Err = appErr
 		return
 	}
 
-	category, appErr := c.App.CreateSidebarCategory(c.Params.UserId, c.Params.TeamId, categoryCreateRequest)
+	category, appErr := c.App.CreateSidebarCategory(c.Params.UserId, c.Params.TeamId, &categoryCreateRequest)
 	if appErr != nil {
 		c.Err = appErr
 		return
diff --git a/api4/channel_category_test.go b/api4/channel_category_test.go
index 586373eb83..b66aca4658 100644
--- a/api4/channel_category_test.go
+++ b/api4/channel_category_test.go
@@ -5,6 +5,7 @@ package api4
 
 import (
 	"encoding/json"
+	"fmt"
 	"testing"
 	"time"
 
@@ -90,6 +91,17 @@ func TestCreateCategoryForTeamForUser(t *testing.T) {
 		require.Equal(t, int64(10), customCategory.SortOrder)
 	})
 
+	t.Run("should not crash with null input", func(t *testing.T) {
+		require.NotPanics(t, func() {
+			user, client := setupUserForSubtest(t, th)
+			payload := []byte(`null`)
+			route := fmt.Sprintf("/users/%s/teams/%s/channels/categories", user.Id, th.BasicTeam.Id)
+			r, err := client.DoAPIPostBytes(route, payload)
+			require.Error(t, err)
+			closeBody(r)
+		})
+	})
+
 	t.Run("should publish expected WS payload", func(t *testing.T) {
 		t.Skip("MM-42652")
 		userWSClient, err := th.CreateWebSocketClient()