Downloading or deleting a file that no longer exists answers 500 instead of 404 #162

New Issue

rays · 2026-10-08T18:36:27-07:00

rays commented

2026-10-08 18:36:27 -07:00

Found in a code audit on 2026-10-09.

POST /api/enclosures/{id}/download and DELETE /api/enclosures/{id} (src/web.rs:1731, src/web.rs:1761) answer a file id that does not exist with a 500, logged as an api error warning, because the missing row is raised with anyhow!, which ApiError turns into a server error. A page left open after a feed was forgotten asks for exactly that. It is the caller's mistake, a 404 like the other lookups, and as a 500 it turns up in the production check as a server error.

Found in a code audit on 2026-10-09. `POST /api/enclosures/{id}/download` and `DELETE /api/enclosures/{id}` (`src/web.rs:1731`, `src/web.rs:1761`) answer a file id that does not exist with a 500, logged as an `api error` warning, because the missing row is raised with `anyhow!`, which `ApiError` turns into a server error. A page left open after a feed was forgotten asks for exactly that. It is the caller's mistake, a 404 like the other lookups, and as a 500 it turns up in the production check as a server error.

rays added the bug label 2026-10-08 18:36:27 -07:00

rays referenced this issue from a commit

2026-10-08 18:57:21 -07:00

Answer a file id that does not exist with 404, not 500 (#162)

rays commented

2026-10-08 18:58:48 -07:00

Fixed in 4db5ee5: both answer 404 "no file {id}". Deployed as 0.10.3-dev on 2026-10-09.

Fixed in 4db5ee5: both answer 404 "no file {id}". Deployed as 0.10.3-dev on 2026-10-09.

rays closed this issue

2026-10-08 18:58:48 -07:00

Sign in to join this conversation.