Skip to content

Do not cast project IDs to string in API response

What does this MR do?

Previously we were casting the invalid project IDs to strings because we were trying to cover the case where the client sends an invalid ID to the backend. This was causing problems on client application because it was expecting the IDs to be integers.

I do believe that the effort of covering the case where client sends an invalid ID will cause(actually did) more problems than it solves therefore I am removing the related logic and assuming the client is always sending us valid IDs in favor of KISS principle.

This MR does not force clients to send IDs as integers since ActiveRecord is using String#to_i to cast strings into integers. Clients can still send IDs as strings which are valid integers like ["1", "2", "3", "4"]. The client can even send and ID like "123asd" which will be casted to integer as 123. But if the client sends an ID like "foobar" then we return a response with invalid_ids containing 0 which I do believe shouldn't be covered.

/closes #196729 (closed)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team

Merge request reports