From 5c025a2f418c57b7b57ecce228217658a160fc35 Mon Sep 17 00:00:00 2001
From: Anders Daljord Morken <amorken@gmail.com>
Date: Tue, 1 Nov 2016 14:25:34 +0100
Subject: [PATCH] query_range: Validate that start comes before end

---
 web/api/v1/api.go      |  5 +++++
 web/api/v1/api_test.go | 11 +++++++++++
 2 files changed, 16 insertions(+)

diff --git a/web/api/v1/api.go b/web/api/v1/api.go
index fc05e160a..a1899cec6 100644
--- a/web/api/v1/api.go
+++ b/web/api/v1/api.go
@@ -182,6 +182,11 @@ func (api *API) queryRange(r *http.Request) (interface{}, *apiError) {
 	if err != nil {
 		return nil, &apiError{errorBadData, err}
 	}
+	if end.Before(start) {
+		err := errors.New("end timestamp must not be before start time")
+		return nil, &apiError{errorBadData, err}
+	}
+
 	step, err := parseDuration(r.FormValue("step"))
 	if err != nil {
 		return nil, &apiError{errorBadData, err}
diff --git a/web/api/v1/api_test.go b/web/api/v1/api_test.go
index 537e49dd9..6a39a12d3 100644
--- a/web/api/v1/api_test.go
+++ b/web/api/v1/api_test.go
@@ -198,6 +198,17 @@ func TestEndpoints(t *testing.T) {
 			},
 			errType: errorBadData,
 		},
+		// Start after end
+		{
+			endpoint: api.queryRange,
+			query: url.Values{
+				"query": []string{"time()"},
+				"start": []string{"2"},
+				"end":   []string{"1"},
+				"step":  []string{"1"},
+			},
+			errType: errorBadData,
+		},
 		{
 			endpoint: api.labelValues,
 			params: map[string]string{