Description

When sending malformed JSON (missing the opening {) to API endpoints that accept JsonObject parameters, several endpoints returned HTTP 500 Internal Server Error with an HTML response instead of HTTP 400 Bad Request with a JSON error message.

Test Results

Expected Result

For malformed JSON input, all endpoints should return:

HTTP/1.1 400 Bad Request
Content-Type: application/json

{ "status": "ERROR", "message": "Invalid JSON" }

Actual Result

• Many endpoints returned 500 Internal Server Error with HTML error pages.
• Some endpoints returned unexpected codes (e.g., 100 Continue with no follow-up).

Steps to Reproduce

1. Create a malformed JSON file:

cat > /tmp/bad.json <<EOF
"foo": "bar"
}
EOF

2. Send to an endpoint, for example:

curl -X POST "http://localhost:8080/api/admin/bannerMessage" \
     -H "Content-type: application/json" \
     -H "X-Dataverse-key: <ADMIN_API_KEY>" \
     --upload-file /tmp/bad.json -v

3. Observe the HTTP status and response format.

Affected Endpoints (from initial tests)

• See table above; more endpoints may be affected based on Phil's list.