From 2e30fffa627dc749d39be35633e8ed72e76dae01 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 9 May 2026 15:26:07 +0000 Subject: [PATCH] Enforce spec: validate query dot notation, improve tooltip service.py: return 400 with a clear message when query= looks like a bare property set name (starts with Pset_ or Qto_ but has no dot). Catches the common mistake of writing Pset_WallCommon instead of Pset_WallCommon.FireRating, giving feedback instead of silent empty results. viewer.html: update query input placeholder and title to show the expected formats (Name, Description for attributes; Pset_X.Prop for property sets). https://claude.ai/code/session_01NBsytCd6L7UQPiKbcLn4kn --- forgejo/custom/public/assets/viewer.html | 4 ++-- ifcurl/service.py | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/forgejo/custom/public/assets/viewer.html b/forgejo/custom/public/assets/viewer.html index 0f4b334..2040854 100644 --- a/forgejo/custom/public/assets/viewer.html +++ b/forgejo/custom/public/assets/viewer.html @@ -224,8 +224,8 @@
diff --git a/ifcurl/service.py b/ifcurl/service.py index e99a892..a16b786 100644 --- a/ifcurl/service.py +++ b/ifcurl/service.py @@ -787,6 +787,18 @@ def query(request: QueryRequest) -> JSONResponse: if not ifc_url.query: raise HTTPException(status_code=400, detail="URL has no 'query' parameter") + query_path = ifc_url.query + if "." not in query_path and ( + query_path.startswith("Pset_") or query_path.startswith("Qto_") + ): + raise HTTPException( + status_code=400, + detail=( + f"'query={query_path}' looks like a property set name — " + f"use dot notation: '{query_path}.PropertyName'" + ), + ) + _ssrf_check(ifc_url) token = request.token