fix(http): return 400 for empty/invalid JSON on required HTTP bodies

qa/L0_sagemaker/sagemaker_test.py

@@ -1,5 +1,5 @@
 #!/usr/bin/python
-# Copyright (c) 2021-2023, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# Copyright (c) 2021-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -382,6 +382,29 @@ def test_malformed_binary_header_large_number(self):
             ),
         )
 
+    def test_empty_json_body_returns_400(self):
+        headers = {"Content-Type": "application/json"}
+        r = requests.post(self.url_, data=b"", headers=headers)
+        self.assertEqual(
+            400,
+            r.status_code,
+            "Expected error code {} returned for empty body; got: {}".format(
+                400, r.status_code
+            ),
+        )
+
+    def test_invalid_json_body_returns_400(self):
+        headers = {"Content-Type": "application/json"}
+        for body in (b"\x00", b" "):
+            r = requests.post(self.url_, data=body, headers=headers)
+            self.assertEqual(
+                400,
+                r.status_code,
+                "Expected error code {} for invalid JSON body {!r}; got: {}".format(
+                    400, body, r.status_code
+                ),
+            )
+
 
 if __name__ == "__main__":
     unittest.main()

qa/L0_sagemaker/test.sh

@@ -59,7 +59,7 @@ SAGEMAKER_MULTI_MODEL_TEST=sagemaker_multi_model_test.py
 SAGEMAKER_GENERATE_TEST=sagemaker_generate_test.py
 SAGEMAKER_GENERATE_STREAM_TEST=sagemaker_generate_stream_test.py
 MULTI_MODEL_UNIT_TEST_COUNT=7
-UNIT_TEST_COUNT=9
+UNIT_TEST_COUNT=11
 GENERATE_UNIT_TEST_COUNT=1
 GENERATE_STREAM_UNIT_TEST_COUNT=1
 CLIENT_LOG="./client.log"

src/http_server.cc

@@ -36,6 +36,7 @@
 
 #include <algorithm>
 #include <cstdlib>
+#include <cstring>
 #include <list>
 #include <regex>
 #include <thread>
@@ -3002,10 +3003,16 @@ HTTPAPIServer::EVRequestToJsonImpl(
   }
 
   *buffer_len = evbuffer_get_length(req->buffer_in);
-  if (allows_empty_body || *buffer_len > 0) {
-    RETURN_IF_ERR(EVBufferToJson(request_json, v, &v_idx, *buffer_len, n));
+  if (*buffer_len == 0) {
+    if (!allows_empty_body) {
+      return TRITONSERVER_ErrorNew(
+          TRITONSERVER_ERROR_INVALID_ARG, "request JSON body is empty");
+    }
+    return nullptr;
   }
 
+  RETURN_IF_ERR(EVBufferToJson(request_json, v, &v_idx, *buffer_len, n));
+
   return nullptr;  // success
 }
 
@@ -3213,7 +3220,18 @@ HTTPAPIServer::EVBufferToJson(
             .c_str());
   }
 
-  RETURN_IF_ERR(document->Parse(json_base, length));
+  TRITONSERVER_Error* parse_err = document->Parse(json_base, length);
+  if (parse_err != nullptr) {
+    if (TRITONSERVER_ErrorCode(parse_err) == TRITONSERVER_ERROR_INTERNAL) {
+      const char* msg = TRITONSERVER_ErrorMessage(parse_err);
+      if (std::strstr(msg, "failed to parse the request JSON buffer") !=
+          nullptr) {
+        TRITONSERVER_ErrorDelete(parse_err);
+        return TRITONSERVER_ErrorNew(TRITONSERVER_ERROR_INVALID_ARG, msg);
+      }
+    }
+    return parse_err;
+  }
 
   return nullptr;  // success
 }