{"record":{"id":"8cba354cca145081","repo":"passbolt/passbolt_api","slug":"invalid-model-name","errorCode":null,"errorMessage":"Invalid model name","messagePattern":"Invalid model name","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"src/Service/Comments/CommentsViewService.php","lineNumber":64,"sourceCode":"    }\n\n    /**\n     * Comments View action\n     *\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the sanity checks failed\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the foreignKey can't be found\n     * @param string $userId The currently logged in user's ID\n     * @param string $foreignModelName name of the foreign model used for the comment\n     * @param string $foreignKey uuid Identifier of the model\n     * @param array $options Query options\n     * @return \\Cake\\ORM\\Query\\SelectQuery\n     */\n    public function view(string $userId, string $foreignModelName, string $foreignKey, array $options = []): SelectQuery\n    {\n        $foreignModelName = ucfirst($foreignModelName);\n        // Check model sanity.\n        if (!in_array($foreignModelName, CommentsTable::ALLOWED_FOREIGN_MODELS)) {\n            throw new BadRequestException('Invalid model name');\n        }\n\n        // Check uuid sanity.\n        if (!Validation::uuid($foreignKey)) {\n            throw new BadRequestException('Invalid id');\n        }\n\n        try {\n            $comments = $this->Comments->findViewForeignComments(\n                $userId,\n                $foreignModelName,\n                $foreignKey,\n                $options\n            );\n        } catch (RecordNotFoundException $e) {\n            throw new NotFoundException(__('Could not find comments for the requested model.'));\n        }\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Service/Comments/CommentsViewService.php#L46-L82","documentation":"Passbolt throws this BadRequestException when the foreign model name given to CommentsViewService::view() is not one of CommentsTable::ALLOWED_FOREIGN_MODELS. The whitelist prevents arbitrary table lookups through the comments endpoint.","triggerScenarios":"Calling view() with a model name (after ucfirst) not in the allowed list, e.g. 'users', 'anything', or lowercase variants of unsupported models; API clients guessing model names in /comments/<model>/<id> URLs.","commonSituations":"Typo in the model segment of the URL; API version changes that narrowed the allowed models; clients assuming other resource types support comments.","solutions":["Use only allowed foreign models (e.g. 'Resource') in the URL or call","Fix case/typos in the model path segment","Consult CommentsTable::ALLOWED_FOREIGN_MODELS for the supported list"],"exampleFix":"// before\nGET /comments/users/<uuid>\n// after\nGET /comments/resources/<uuid>","handlingStrategy":"validation","validationCode":"use App\\Model\\Table\\CommentsTable;\nif (!in_array(ucfirst($model), CommentsTable::ALLOWED_FOREIGN_MODELS, true)) { /* reject before call */ }","typeGuard":"function isAllowedForeignModel(string $model): bool { return in_array(ucfirst($model), CommentsTable::ALLOWED_FOREIGN_MODELS, true); }","tryCatchPattern":"try { $service->view($userId, $model, $foreignKey); } catch (BadRequestException $e) { /* unsupported model: correct URL */ }","preventionTips":["Hardcode supported model segments in client URL builders","Check ALLOWED_FOREIGN_MODELS when adding new comment targets","Validate model names in route templates"],"tags":["validation","whitelist","comments","bad-request"],"backgroundTag":"invalid-enum-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}