Feature property fixes (#1932)

Author: tomkralidis

pygeoapi/provider/csv_.py

@@ -2,7 +2,7 @@
 #
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #
-# Copyright (c) 2022 Tom Kralidis
+# Copyright (c) 2025 Tom Kralidis
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation
@@ -32,8 +32,9 @@
 import itertools
 import logging
 
-from pygeoapi.provider.base import (BaseProvider, ProviderQueryError,
-                                    ProviderItemNotFoundError)
+from pygeoapi.provider.base import (BaseProvider, ProviderInvalidQueryError,
+                                    ProviderItemNotFoundError,
+                                    ProviderQueryError)
 from pygeoapi.util import get_typed_value, crs_transform
 
 LOGGER = logging.getLogger(__name__)
@@ -120,6 +121,12 @@ def _load(self, offset=0, limit=10, resulttype='results',
             LOGGER.debug('Serializing DictReader')
             data_ = csv.DictReader(ff)
             if properties:
+                for prop in properties:
+                    if prop[0] not in data_.fieldnames:
+                        msg = 'Invalid fieldname'
+                        LOGGER.error(msg)
+                        raise ProviderInvalidQueryError(msg)
+
                 data_ = filter(
                     lambda p: all(
                         [p[prop[0]] == prop[1] for prop in properties]), data_)
@@ -139,6 +146,7 @@ def _load(self, offset=0, limit=10, resulttype='results',
                     msg = f'Skipping row with invalid geometry: {row.get(self.id_field)}'  # noqa
                     LOGGER.error(msg)
                     continue
+
                 feature = {'type': 'Feature'}
                 feature['id'] = row.pop(self.id_field)
                 if not skip_geometry:

pygeoapi/provider/tinydb_.py

@@ -2,7 +2,7 @@
 #
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #
-# Copyright (c) 2024 Tom Kralidis
+# Copyright (c) 2025 Tom Kralidis
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation
@@ -37,6 +37,7 @@
 from tinydb import TinyDB, Query, where
 
 from pygeoapi.provider.base import (BaseProvider, ProviderConnectionError,
+                                    ProviderInvalidQueryError,
                                     ProviderItemNotFoundError)
 from pygeoapi.util import crs_transform, get_typed_value
 
@@ -197,7 +198,12 @@ def query(self, offset=0, limit=10, resulttype='results',
         LOGGER.debug('querying database')
         if len(QUERY) > 0:
             LOGGER.debug(f'running eval on {SEARCH_STRING}')
-            results = eval(SEARCH_STRING)
+            try:
+                results = eval(SEARCH_STRING)
+            except SyntaxError as err:
+                msg = 'Invalid query'
+                LOGGER.error(f'{msg}: {err}')
+                raise ProviderInvalidQueryError(msg)
         else:
             results = self.db.all()
 

pygeoapi/templates/exception.html

@@ -3,6 +3,6 @@
 {% block body %}
     <section id="exception">
       <h2>{% trans %}Exception{% endtrans %}</h2>
-      <p>{{ data['description'] }}</p>
+      <p>{{ data['description'] | striptags }}</p>
     </section>
 {% endblock %}

tests/test_csv__provider.py

@@ -2,7 +2,7 @@
 #
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #
-# Copyright (c) 2021 Tom Kralidis
+# Copyright (c) 2025 Tom Kralidis
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation
@@ -29,7 +29,8 @@
 
 import pytest
 
-from pygeoapi.provider.base import ProviderItemNotFoundError
+from pygeoapi.provider.base import (ProviderItemNotFoundError,
+                                    ProviderInvalidQueryError)
 from pygeoapi.provider.csv_ import CSVProvider
 
 from .util import get_test_file_path
@@ -117,6 +118,13 @@ def test_query(config):
     assert len(results['features'][0]['properties']) == 2
 
 
+def test_get_invalid_property(config):
+    """Testing query for an invalid property name"""
+    p = CSVProvider(config)
+    with pytest.raises(ProviderInvalidQueryError):
+        p.query(properties=[('foo', 'bar')])
+
+
 def test_get(config):
     p = CSVProvider(config)
 

tests/test_tinydb_provider.py

@@ -2,7 +2,7 @@
 #
 # Authors: Tom Kralidis <tomkralidis@gmail.com>
 #
-# Copyright (c) 2024 Tom Kralidis
+# Copyright (c) 2025 Tom Kralidis
 #
 # Permission is hereby granted, free of charge, to any person
 # obtaining a copy of this software and associated documentation
@@ -32,7 +32,8 @@
 
 import pytest
 
-from pygeoapi.provider.base import ProviderItemNotFoundError
+from pygeoapi.provider.base import (ProviderItemNotFoundError,
+                                    ProviderInvalidQueryError)
 from pygeoapi.provider.tinydb_ import TinyDBProvider
 
 from .util import get_test_file_path
@@ -156,6 +157,13 @@ def test_query(config):
     assert results['features'][0]['id'] == '02HC003.2017-05-27'
 
 
+def test_get_invalid_property(config):
+    """Testing query for an invalid property name"""
+    p = TinyDBProvider(config)
+    with pytest.raises(ProviderInvalidQueryError):
+        p.query(properties=[('\'foo', 'bar')])
+
+
 def test_get(config):
     p = TinyDBProvider(config)