Validate filter params

[isaac-blanc]

Problem

If I define a FilterSet for a Person model...

class PersonFilter(FilterSet):
    class Meta:
        model = Person
        fields = [
            'name',
            'height',
        ]

And I then call the endpoint with a misspelled filter param...

requests.get(url, params={'nome': 'Susan'})

Then I feel like the endpoint should raise an error. Instead, it merely ignores this filter param and returns all Person records.

Solutions

I had thought the unknown_field_behavior option would fix this, but apparently it already defaults to RAISE and yet the problem persists. Folk on StackOverflow propose overwriting FilterSet methods here and here. I am happy to take that approach, but I thought I would first check whether this is a built-in feature yet? I would have expected this to be the standard behaviour and not something we had to implement ourselves. I have likely overlooked something, but I am curious to know what?

[carltongibson]

Hi @isaac-blanc.

So first you have to decide if the FilterSet parameters are both required and the only allowable ones in the query string.

If you also want to allow (e.g.) pagination, then you can't just insist that the keys in request.GET match the FilterSet fields exactly. If some filters aren't required then you have to allow that they're missing. And so on.

However, given all that, you can check FilterSet.is_valid() in your view, and if not perhaps raise an error.

The DRF backend does this when filtering if you set the raise_exception attribute there:

django-filter/django_filters/rest_framework/backends.py

Lines 70 to 71 in 635343e

	if not filterset.is_valid() and self.raise_exception:
	raise utils.translate_validation(filterset.errors)

If you're dealing with the FilterSet directly in your view, then you'd do similar there.

[carltongibson]

I suspect it's because your filters are not required (so if they're missing the form is still valid)

[isaac-blanc]

Yes, my filters are not required but that is the desired behaviour. I only want to raise an exception in the case that an unexpected (ie: additional) parameter is passed (such as a misspelled parameter). I understand this will cause problems with other query string parameters, such as pagination, but I think I'm willing to pay that price. Might you be able to recommend an approach?

[carltongibson]

Just do the set operation on request.GET keys with the filterset form field names. If they're not the same you can raise a 400.

[isaac-blanc]

Just got back to this. Have extended FilterSet as shown below. As far as I can tell, it works great. Would be grateful if you could cast an eye over it, although of course no worries if you haven't got the time. Thanks for your help!

class SafeFilterSet(FilterSet):
    
    def is_valid(self):
        expected_fields = set(self.form.fields)
        received_fields = set(self.request.GET.keys())
        
        if unexpected_fields := received_fields - expected_fields:
            raise ValueError(f'Received unexpected filter fields: {unexpected_fields}')
        
        return super().is_valid()

[carltongibson]

Seems fine, yes. 👍