Fix: Validate lastsuccess query param in BuildController

src/api/app/controllers/build_controller.rb

@@ -143,7 +143,20 @@ def logfile
 
   def result
     # this route is mainly for checking submissions to a target project
-    return result_lastsuccess if params.key?(:lastsuccess)
+    # allowed values are true/false or 1/0
+    if params.key?(:lastsuccess)
+      allowed_values = ['1', '0', 'true', 'false', 1, 0, true, false]
+
+      unless allowed_values.include?(params[:lastsuccess])
+        return render_error(
+          status: 400,
+          errorcode: 'invalid_lastsuccess_value',
+          message: 'Invalid value for lastsuccess. Expected true/false or 1/0.'
+        )
+      end
+
+      return result_lastsuccess
+    end
 
     # for permission check
     Project.get_by_name(params[:project])

src/api/test/functional/build_controller_test.rb

@@ -309,8 +309,34 @@ def test_result
     assert_xml_tag tag: 'resultlist', children: { count: 2 }
 
     get '/build/home:Iggy/_result?lastsuccess&pathproject=kde4&package=TestPack'
+    assert_response :bad_request
+    assert_xml_tag(tag: 'status', attributes: { code: 'invalid_lastsuccess_value' })
+  end
+
+  def test_result_lastsuccess_true
+    get '/build/home:Iggy/_result?lastsuccess=true&pathproject=kde4&package=TestPack'
+    assert_response :not_found
+  end
+
+  def test_result_lastsuccess_false
+    get '/build/home:Iggy/_result?lastsuccess=false&pathproject=kde4&package=TestPack'
     assert_response :not_found
-    assert_xml_tag(tag: 'status', attributes: { code: 'no_repositories_found' })
+  end
+
+  def test_result_lastsuccess_one
+    get '/build/home:Iggy/_result?lastsuccess=1&pathproject=kde4&package=TestPack'
+    assert_response :not_found
+  end
+
+  def test_result_lastsuccess_zero
+    get '/build/home:Iggy/_result?lastsuccess=0&pathproject=kde4&package=TestPack'
+    assert_response :not_found
+  end
+
+  def test_result_invalid_lastsuccess_param
+    get '/build/home:Iggy/_result?lastsuccess=abc'
+    assert_response :bad_request
+    assert_xml_tag(tag: 'status', attributes: { code: 'invalid_lastsuccess_value' })
   end
 
   def test_result_of_failed_publish