Repository: zulip/zulip

Issue:
We should 404 on /api/api-doc-template, not 500
Requesting `/api/api-doc-template` directly hits this code:
https://github.com/zulip/zulip/blob/c2148dc4d9e2ba1ea96d8ee0c972fcf77af43e8d/zerver/views/documentation.py#L190-L196

Those `assert`s cause the request to 500, since `/zerver/api/api-doc-template.md` is an internal URL which is not meant to be accessed directly.

Right above these lines:
https://github.com/zulip/zulip/blob/c2148dc4d9e2ba1ea96d8ee0c972fcf77af43e8d/zerver/views/documentation.py#L107-L110

...we should add a check for:
```python3
if path == "/zerver/api/api-doc-template.md":
    # This shouldn't be accessible directly
    return DocumentationArticle(
        article_path=self.path_template % ("missing",),
        article_http_status=404,
        endpoint_path=None,
        endpoint_method=None,
    )


Discussion:
ha!  @alexmv did you see this in the CZO logs today?  I ran a test today while working on [PR 21835](https://github.com/zulip/zulip/pull/21835) to provide 100% test coverage for a dozen files, including the API docs.

Anyway, if you want to play reviewer on that PR, I can trivially include this (and the test case...) :-)

Hello @zulip/server-api members, this issue was labeled with the "area: documentation (api and integrations)" label, so you may want to check it out!

<!-- areaLabelAddition -->

Yeah feel free to submit a PR for this @asah!
And yes, feel free to poke me on #21835 once it's ready for review.
Hey can I contribute on this issue too?
@zulipbot claim
@zulipbot unclaim
@zulipbot claim

Hello @asah, it looks like you've currently claimed 1 issue in this repository. We encourage new contributors to focus their efforts on at most 1 issue at a time, so please complete your work on your other claimed issues before trying to claim this issue again.

We look forward to your valuable contributions!

@zulipbot claim
@alexmv weird - I can't reproduce this, e.g. these both return 404 today:
https://chat.zulip.org/api/api-doc-template.md
https://chat.zulip.org/zerver/api/api-doc-template.md

https://zulip.com/api/api-doc-template replicates, as does https://chat.zulip.org/api/api-doc-template
@karanka You have been unassigned from this issue because you have not made any updates for over 14 days. Please feel free to reclaim the issue if you decide to pick up again. Thanks!

Got it

On Fri, Apr 22, 2022, 8:36 PM Alex Vandiver ***@***.***>
wrote:

> https://zulip.com/api/api-doc-template replicates
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/zulip/zulip/issues/21876#issuecomment-1107072759>, or
> unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AABCFYVNRAKRJIHOPVC7AG3VGNAZZANCNFSM5UADOAZA>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>


Resolving patch:
diff --git a/zerver/views/documentation.py b/zerver/views/documentation.py
--- a/zerver/views/documentation.py
+++ b/zerver/views/documentation.py
@@ -110,6 +110,15 @@ def get_path(self, article: str) -> DocumentationArticle:
                 endpoint_method=None,
             )
 
+        if path == "/zerver/api/api-doc-template.md":
+            # This template shouldn't be accessed directly.
+            return DocumentationArticle(
+                article_path=self.path_template % ("missing",),
+                article_http_status=404,
+                endpoint_path=None,
+                endpoint_method=None,
+            )
+
         # The following is a somewhat hacky approach to extract titles from articles.
         # Hack: `context["article"] has a leading `/`, so we use + to add directories.
         article_path = os.path.join(settings.DEPLOY_ROOT, "templates") + path


Test patch:
diff --git a/zerver/tests/test_docs.py b/zerver/tests/test_docs.py
--- a/zerver/tests/test_docs.py
+++ b/zerver/tests/test_docs.py
@@ -137,6 +137,14 @@ def test_api_doc_endpoints(self) -> None:
         )
         self.assertEqual(result.status_code, 404)
 
+        result = self.client_get(
+            # This template shouldn't be accessed directly.
+            "/api/api-doc-template",
+            follow=True,
+            HTTP_X_REQUESTED_WITH="XMLHttpRequest",
+        )
+        self.assertEqual(result.status_code, 404)
+
         # Test some API doc endpoints for specific content and metadata.
         self._test("/api/", "The Zulip API")
         self._test("/api/api-keys", "be careful with it")