Repository: CVEProject/cve-services (js)

Issue:
Unclear error message for PUT /cve/:id/cna
## Summary

Similar to issue #608 , when updating a Cve record using the PUT `/cve/:id/cna` endpoint, if the `cnaContainer` json contains and `x_` field with a value that includes a `$`, a generic 500 error is thrown. This should be changed to throw a more helpful error like in issue #608. The error message should use the `unableToStoreRecord` error with the message `A problem occurred while saving the CVE Record, ensure that x_ values do not start with $`.

Pull request:
Resolves #1006 added specific error handler for $ in x_fields
Closes #1006

# Summary
Added error handler and specific error message to handle `$` in `x_` fields, because these aren't allowed in DocDB and need to be handled.

# Important Changes
`cve.controller.js`
- added `Try...Catch` in `updateCna` function to throw a 400 for `$`s  .

# Testing

Steps to manually test updated functionality, if possible
- [ ] 1) Ensure the correct error is thrown when `$` are in a `x_` field in the cnaContainer. 

# Notes
- This is only an error with DocDB and will not occur running with MongoDB locally.


Patch:
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index f5901e80..9c342b4a 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -588,13 +588,18 @@ async function updateCna (req, res, next) {
       return res.status(400).json(error.invalidCnaContainerJsonSchema(result.errors))
     }
 
-    await cveRepo.updateByCveId(id, cveModel)
-    // change cve id state to publish
-    if (cveId.state === CONSTANTS.CVE_STATES.REJECTED) {
-      result = await cveIdRepo.updateByCveId(id, { state: CONSTANTS.CVE_STATES.PUBLISHED })
-      if (!result) {
-        return res.status(500).json(error.serverError())
+    try {
+      await cveRepo.updateByCveId(id, cveModel)
+      // change cve id state to publish
+      if (cveId.state === CONSTANTS.CVE_STATES.REJECTED) {
+        result = await cveIdRepo.updateByCveId(id, { state: CONSTANTS.CVE_STATES.PUBLISHED })
+
+        if (!result) {
+          return res.status(400).json(error.unableToStoreCveRecord())
+        }
       }
+    } catch (err) {
+      return res.status(400).json(error.unableToStoreCveRecord())
     }
 
     const responseMessage = {


Test patch:
diff --git a/test/unit-tests/cve/cveCnaContainerUpdateTest.js b/test/unit-tests/cve/cveCnaContainerUpdateTest.js
index cad7c512..ab0ad077 100644
--- a/test/unit-tests/cve/cveCnaContainerUpdateTest.js
+++ b/test/unit-tests/cve/cveCnaContainerUpdateTest.js
@@ -228,7 +228,7 @@ describe('Testing the PUT /cve/:id/cna endpoint in Cve Controller', () => {
         })
     })
 
-    it('should return 500 when fails to update cve id state', (done) => {
+    it('should return 400 when fails to update cve id state', (done) => {
       chai.request(app)
         .put(`/cve-cna-negative-tests/${cveIdPublished5}`)
         .set(cveFixtures.secretariatHeader)
@@ -238,9 +238,9 @@ describe('Testing the PUT /cve/:id/cna endpoint in Cve Controller', () => {
             done(err)
           }
 
-          expect(res).to.have.status(500)
+          expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.serverError()
+          const errObj = error.unableToStoreCveRecord()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()