-
Notifications
You must be signed in to change notification settings - Fork 357
Description
Webapiv7 throws ResourceTypeAnnotationNotFirst
error when payload has both @removed and @odata.type.
Our clients seem to be reusing the same class structure for both normal OData payloads for POST and Delta payloads.
This issue was not encountered by our clients in the older OData versions, possibly because the concept of @removed did not exist in older libraries.
The library seems to be reordering the json payload in this order: @odata.context > @removed > @odata.type
.
So, when @removed property is encountered, it skips checking for @odata.type property. However, the logic later in the ReadEntryInstanceAnnotation()
method in ODataJsonLightResourceDeserializer.cs
assumes that @odata.type was already encountered in ReadResourceStart and hence considers the occurrence as duplicate or occurring in an incorrect order.
Assemblies affected
OData WebApi lib 7x.
Reproduce steps
Consider the following payload sent to the POST planner/plans endpoint to create a new plan
{
"@odata.type": "#microsoft.taskServices.plan",
"title": "The Plan",
"@removed": false,
"owner": "abcd"
}
Expected result
201 Created
{"@odata.context":"http://localhost/V3.0/$metadata#plans/$entity","owner":"abcd","title":"The Plan"}
Actual result
400 BadRequest
"error":{"code":"","message":"The request is invalid:\r\nThe 'odata.type' instance annotation in a resource object is preceded by an invalid property. In OData, the 'odata.type' instance annotation must be either the first property in the JSON object or the second if the 'odata.context' instance annotation is present."
Additional detail
We have upgraded odata to v7 and deployed the changes to Prod and are receiving incidents from our clients due to this issue. We are blocked from deploying to further regions.