Reporting REST throws 500 when getting Evaluated Report Definition

piumal1999 · June 18, 2021, 11:49am

Hi all, I encountered and 500 server error when using the reporting-rest API to get a evaluated report definition. The endpoint I used is GET http://localhost:9000/openmrs/ws/rest/v1/reportingrest/reportdata/b12bd37f-328f-4ebb-b0fe-10b915ebb8cd?startDate=2020-01-01&endDate=2020-12-31&location=2131aff8-2e2a-480a-b7ab-4ac53250262b&v=custom:(dataSets)

It throws a 500 error due to a ConversionException

You can reproduce the issue from here too

piumal1999 · June 18, 2021, 11:57am

Update:

I tried to reproduce the error using demo.openmrs.org but the endpoint works fine there. Maybe it’s an error with the new SNAPSHOT.

The version i used: Reporting REST 1.12.0-SNAPSHOT
The version in demo server: Reporting REST 1.11.0

So i’ll try installing the version 1.11.0

piumal1999 · June 19, 2021, 11:58am

It didn’t work either. I replaced all the modules in my local instance with the module versions which are used in the demo.openmrs.org But still it throws an internal server error when accessing the endpoint.

piumal1999 · June 19, 2021, 12:15pm

Hi @k.joseph , Could you please have a look and give me any clue on this issue. I’m not sure why it works in demo server, but not in the local instance. The DHIS Connector module Run reports function doesn’t work due to this error.

Thank you

cc: @dkayiwa

dkayiwa · June 19, 2021, 6:01pm

Try reproducing it here: https://qa-refapp.openmrs.org/

piumal1999 · June 19, 2021, 6:26pm

@dkayiwa Thanks for the response.

The error occurs in here too.

Steps to reproduce:

Logged in
Created a cohort query using reporting module (I created an All patients Query)
Created a new period indicator report
Added a indicator using the cohort query created earlier
image1956×1012 124 KB
Used the endpoint with the uuid of period indicator report

Preview: Login to qa-refapp.openmrs.org and go to the link below:

https://qa-refapp.openmrs.org/openmrs/ws/rest/v1/reportingrest/reportdata/c6b495dd-6175-494e-aacb-6d4862235de1?startDate=2020-01-01&endDate=2020-12-31&location=2131aff8-2e2a-480a-b7ab-4ac53250262b&v=custom:(dataSets)

dkayiwa · June 19, 2021, 8:42pm

How do you get the reportdata uuid?

piumal1999 · June 19, 2021, 9:46pm

I got it from the path parameter

https://qa-refapp.openmrs.org/openmrs/module/reporting/reports/periodIndicatorReport.form?uuid=c6b495dd-6175-494e-aacb-6d4862235de1

. .

PS: Also i rechecked it from https://qa-refapp.openmrs.org/openmrs/ws/rest/v1/reportingrest/reportDefinition endpoint.

<reportDefinition>
  <uuid>c6b495dd-6175-494e-aacb-6d4862235de1</uuid>
  <display>Population</display>
  <links>
    <link>
      <rel>self</rel>
      <uri>http://qa-refapp.openmrs.org/openmrs/ws/reporting/v1/reportingrest/reportDefinition/c6b495dd-6175-494e-aacb-6d4862235de1</uri>
    </link>
  </links>
</reportDefinition>

cc: @dkayiwa @k.joseph

k.joseph · June 22, 2021, 8:47am

This looks to be a bug somewhere in the reporting feature, cc @mseaton.

You need to do some investigation to work on a fix for this

mseaton · June 22, 2021, 2:20pm

Nothing obvious jumps to mind. The underlying error appears to be:

java.lang.NoSuchMethodException: Unknown property ‘class’ on class ‘class org.openmrs.module.reporting.dataset.definition.CohortIndicatorDataSetDefinition’ org.apache.commons.beanutils.PropertyUtilsBean.getSimpleProperty(PropertyUtilsBean.java:1270) org.apache.commons.beanutils.PropertyUtilsBean.getNestedProperty(PropertyUtilsBean.java:809) org.apache.commons.beanutils.PropertyUtilsBean.getProperty(PropertyUtilsBean.java:885) org.apache.commons.beanutils.PropertyUtils.getProperty(PropertyUtils.java:464) org.openmrs.module.webservices.rest.web.resource.impl.BaseDelegatingResource.getProperty(BaseDelegatingResource.java:751) org.openmrs.module.webservices.rest.web.resource.impl.DelegatingResourceDescription$Property.evaluate(DelegatingResourceDescription.java:245) org.openmrs.module.webservices.rest.web.resource.impl.BaseDelegatingConverter.convertDelegateToRepresentation(BaseDelegatingConverter.java:143) org.openmrs.module.webservices.rest.web.resource.impl.BaseDelegatingResource.asRepresentation(BaseDelegatingResource.java:382) org.openmrs.module.webservices.rest.web.ConversionUtil.convertToRepresentation(ConversionUtil.java:405) org.openmrs.module.webservices.rest.web.ConversionUtil.convertToRepresentation(ConversionUtil.java:372) org.openmrs.module.webservices.rest.web.resource.impl.DelegatingResourceDescription$Property.evaluate(DelegatingResourceDescription.java:252) org.openmrs.module.webservices.rest.web.resource.impl.BaseDelegatingConverter.convertDelegateToRepresentation(BaseDelegatingConverter.java:143) org.openmrs.module.webservices.rest.web.resource.impl.BaseDelegatingResource.asRepresentation(BaseDelegatingResource.java:382) org.openmrs.module.webservices.rest.web.ConversionUtil.convertToRepresentation(ConversionUtil.java:405) org.openmrs.module.webservices.rest.web.ConversionUtil.convertToRepresentation(ConversionUtil.java:372) org.openmrs.module.webservices.rest.web.resource.impl.DelegatingResourceDescription$Property.evaluate(DelegatingResourceDescription.java:249) org.openmrs.module.webservices.rest.web.resource.impl.BaseDelegatingConverter.convertDelegateToRepresentation(BaseDelegatingConverter.java:143) org.openmrs.module.webservices.rest.web.resource.impl.BaseDelegatingResource.asRepresentation(BaseDelegatingResource.java:415) org.openmrs.module.reportingrest.web.resource.EvaluatedReportDefinitionResource.retrieve(EvaluatedReportDefinitionResource.java:80) org.openmrs.module.webservices.rest.web.v1_0.controller.MainResourceController.retrieve(MainResourceController.java:74) sun.reflect.GeneratedMethodAccessor3222.invoke(Unknown Source) sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

Someone probably needs to run this through the debugger and see what is going on within the web services module or reporting rest module.

Mike

dkayiwa · June 22, 2021, 7:24pm

Version 1.9.4 of Apache Commons BeanUtils was released primarily as a security bug fix for CVE-2014-0114 to disallow accessing the ‘class’ property. They have an option to opt out of this new default behaviour as demonstrated in this test.

But instead of making OpenMRS less secure by allowing access to the class property, i would rather that we just get rid of this feature.

cc @isears @jnsereko

piumal1999 · June 30, 2021, 5:41pm

Thank you @dkayiwa for helping. I tested this by updating the reporting rest module locally and it works!!! I just removed the class property.

Shall I create an issue on JIRA and send a pull request to fix this?

dkayiwa · June 30, 2021, 6:08pm

Yes please!

piumal1999 · June 30, 2021, 6:27pm

Sure @dkayiwa . I created the issue. https://issues.openmrs.org/projects/REPORT/issues/REPORT-879?filter=allissues Could you please review it and mark it as ‘Ready for work’

Thanks

dkayiwa · June 30, 2021, 6:37pm

Just done that.

piumal1999 · June 30, 2021, 6:53pm

Thanks @dkayiwa I Sent the Pull Request and it’s ready for review

Please review and merge

piumal1999 · July 1, 2021, 1:02pm

Thanks for merging the Pull Request