Status Code change when calling API

[zhyuanqi]

DESCRIPTION: When utilizing the UI console to interact with the endpoint it expects a 'POST' request to pass the API calls within the request. However, if the request is changed to a 'GET', 'HEAD', 'DELETE', and occasionally 'PATCH' it results in a '500 Internal Server Error' message as a response.
Additionally, within the path= parameter if a character that is not a word character is passed such as <, it results in a '500 Internal Server Error' message as well.

Example:

╰─ curl -s -i -X 'GET' 'https://SEARCH_ENDPOINT/_dashboards/api/console/proxy?path=/var/tmp<&method=POST' -H 'Content-Type: application/json' -H 'Osd-Xsrf: opensearchDashboards' -b $COOKIE -d '{}'
HTTP/2 500
date: Tue, 10 May 2022 15:47:52 GMT
content-type: application/json
content-length: 16
access-control-allow-origin: *

{"message":null}%

Suggestion:
In general, HTTP 500 responses are indicative of improperly handled errors; correctly handled error conditions should generally result in HTTP 4xx response codes. See

[abbyhu2000]

I think this is related to a previous proposal on better presenting and handling errors and following the error status code: #1625. Since this is related to error presenting and handling as a whole, i think it will require some time allocation. Are we prioritizing this issue?

[abbyhu2000]

Tried to reproduce and get the same 500 error status code. Need to have a SEARCH_ENDPOINT and COOKIE for reproducing the error.