Skip to content

feat(api): Publish typed issue view creation endpoint - #123079

Open
cvxluo wants to merge 1 commit into
masterfrom
cvxluo/publish-typed-issue-view-creation-endpoint
Open

feat(api): Publish typed issue view creation endpoint#123079
cvxluo wants to merge 1 commit into
masterfrom
cvxluo/publish-typed-issue-view-creation-endpoint

Conversation

@cvxluo

@cvxluo cvxluo commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Publish the issue view creation endpoint. Redux of #122537
Cover it in the agent-token public API matrix with the required feature flag and payload.

Refs IS-15

Publish the issue view creation endpoint.
Cover it in the agent-token public API matrix with the required feature flag and payload.

Refs IS-15

Co-authored-by: Codex <noreply@openai.com>
@linear-code

linear-code Bot commented Aug 28, 2026

Copy link
Copy Markdown

IS-15

@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Aug 28, 2026
@cvxluo
cvxluo marked this pull request as ready for review August 28, 2026 22:41
@cvxluo
cvxluo requested review from a team as code owners August 28, 2026 22:41
Comment on lines +37 to +39
@extend_schema_field(GroupSearchViewTimeFiltersSerializer)
class GroupSearchViewTimeFiltersField(serializers.DictField):
pass

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The timeFilters field in GroupSearchViewPostValidator uses a DictField without a child validator, allowing malformed dictionary structures to pass validation and be saved to the database.
Severity: MEDIUM

Suggested Fix

To enforce the expected structure at runtime, replace the DictField with a nested serializer. Define a GroupSearchViewTimeFiltersSerializer with fields for start, end, period, and utc, and use it as the validator for the timeFilters field. This will ensure that only correctly structured data is accepted. Additionally, add a test case that attempts to create a view with malformed timeFilters to verify that the request is rejected.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/api/serializers/rest_framework/groupsearchview.py#L37-L39

Potential issue: The `GroupSearchViewTimeFiltersField` is defined as a `DictField`
without a `child` validator. While the OpenAPI schema is decorated to expect a specific
structure for `timeFilters`, the runtime validation does not enforce it. This allows any
non-empty dictionary to be accepted, regardless of its keys or value types. An API
client can send a malformed `timeFilters` object, such as `{"randomKey":
"randomValue"}`, which will be successfully validated and stored in the database. This
can lead to unexpected behavior or errors in the frontend when the
`normalizeDateTimeParams` function processes this corrupted view configuration.

Also affects:

  • src/sentry/api/serializers/rest_framework/groupsearchview.py:83~88

Did we get this right? 👍 / 👎 to inform future reviews.

@wedamija

Copy link
Copy Markdown
Member

This reminded me that I never merged #122950, just merged it now. Could you rebase on this so we can verify that this won't break master?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants