Config Type Input Validation (#3471)

Signed-off-by: Nik Willwerth <nwillwerth@kubecost.com>

pkg/cloud/config/controller_handlers.go

@@ -65,6 +65,10 @@ func (c *Controller) GetAddConfigHandler() func(w http.ResponseWriter, r *http.R
 		w.Header().Set("Content-Type", "application/json")
 
 		configType := r.URL.Query().Get("type")
+		if configType == "" {
+			http.Error(w, "'type' parameter is required", http.StatusBadRequest)
+			return
+		}
 
 		config, err := ParseConfig(configType, r.Body)
 		if err != nil {

pkg/cloud/config/controller_handlers_test.go

@@ -2,6 +2,8 @@ package config
 
 import (
 	"bytes"
+	"net/http"
+	"net/http/httptest"
 	"reflect"
 	"strings"
 	"testing"
@@ -133,3 +135,52 @@ func Test_ParseConfig_Azure(t *testing.T) {
 		t.Fatalf("parsed config does not match original config:\n%+v\n%+v", parsedConfig, config)
 	}
 }
+
+func Test_GetAddConfigHandler(t *testing.T) {
+	controller := &Controller{
+		storage: &MemoryControllerStorage{},
+	}
+
+	handler := controller.GetAddConfigHandler()
+	if handler == nil {
+		t.Fatalf("expected handler, got nil")
+	}
+
+	// Test no type param
+	req := httptest.NewRequest("GET", "/", nil)
+	w := httptest.NewRecorder()
+	handler(w, req, nil)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 status code, got %v: %v", w.Code, w.Body.String())
+	}
+
+	// Test no config body
+	req = httptest.NewRequest("GET", "/?type="+S3ConfigType, nil)
+	w = httptest.NewRecorder()
+	handler(w, req, nil)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 status code, got %v: %v", w.Code, w.Body.String())
+	}
+
+	// Test with config body
+	mockConfig := aws.S3Configuration{
+		Bucket:  "bucket",
+		Region:  "region",
+		Account: "account",
+		Authorizer: &aws.AccessKey{
+			ID:     "id",
+			Secret: "secret",
+		},
+	}
+	configBytes, err := json.Marshal(mockConfig)
+	if err != nil {
+		t.Fatalf("failed to marshal config: %v", err)
+	}
+
+	req = httptest.NewRequest("GET", "/?type="+S3ConfigType, bytes.NewReader(configBytes))
+	w = httptest.NewRecorder()
+	handler(w, req, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200 status code, got %v: %v", w.Code, w.Body.String())
+	}
+}