free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request

@@ -5,7 +5,7 @@ go 1.25.5
 require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/free5gc/openapi v1.2.3
-	github.com/free5gc/util v1.3.2-0.20260102062829-eaf663340255
+	github.com/free5gc/util v1.3.2-0.20260107090449-c09baaf75b11
 	github.com/gin-gonic/gin v1.10.0
 	github.com/google/uuid v1.6.0
 	github.com/h2non/gock v1.2.0

@@ -27,8 +27,8 @@ github.com/free5gc/ngap v1.1.2 h1:AA+s9+eaE8fSTnmBbh1xiD3VPaszonCd7AQJGKX5PHM=
 github.com/free5gc/ngap v1.1.2/go.mod h1:4HYtB+msoTBc3cEPlSr4ZUUHn3BFZhdPuVASERMzVeI=
 github.com/free5gc/openapi v1.2.3 h1:w4TmYBR8TUE4ZgKo7eiMZbyZPURSBFlMWiFeX+OsiA8=
 github.com/free5gc/openapi v1.2.3/go.mod h1:fLvaBtUZrvrzkKrmn5Aza+JNbpWnp3kxKixu6kLSD3k=
-github.com/free5gc/util v1.3.2-0.20260102062829-eaf663340255 h1:IlMgigBSERsAwHhhDmDJpc5Xrmz8ML5Zg7Bd7SOVyyI=
-github.com/free5gc/util v1.3.2-0.20260102062829-eaf663340255/go.mod h1:qsv/ez8YhI+pO8bjNiZWXc2xmRE3XuEIa0EDTCPkSy0=
+github.com/free5gc/util v1.3.2-0.20260107090449-c09baaf75b11 h1:/UZetXmPa5T/TKKxqU3Osw9x3+nIuACTXJxOU+gYGTU=
+github.com/free5gc/util v1.3.2-0.20260107090449-c09baaf75b11/go.mod h1:qsv/ez8YhI+pO8bjNiZWXc2xmRE3XuEIa0EDTCPkSy0=
 github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
 github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=

@@ -12,6 +12,7 @@ import (
 	"github.com/free5gc/openapi/models"
 	"github.com/free5gc/udm/internal/logger"
 	"github.com/free5gc/util/metrics/sbi"
+	"github.com/free5gc/util/validator"
 )
 
 func (s *Server) getSubscriberDataManagementRoutes() []Route {
@@ -33,7 +34,21 @@ func (s *Server) HandleGetAmData(c *gin.Context) {
 
 	logger.SdmLog.Infof("Handle GetAmData")
 
+	// TS 29.503 6.1.3.5.2
+	// Validate SUPI format
 	supi := c.Params.ByName("supi")
+	if !validator.IsValidSupi(supi) {
+		problemDetail := models.ProblemDetails{
+			Title:  "Malformed request syntax",
+			Status: http.StatusBadRequest,
+			Detail: "Supi is invalid",
+			Cause:  "MANDATORY_IE_INCORRECT",
+		}
+		logger.SdmLog.Warnln("Supi is invalid")
+		c.Set(sbi.IN_PB_DETAILS_CTX_STR, http.StatusText(int(problemDetail.Status)))
+		c.JSON(int(problemDetail.Status), problemDetail)
+		return
+	}
 
 	// use c.Request.URL.Query() only for getPlmnIDStruct
 	plmnIDStruct, problemDetails := s.getPlmnIDStruct(c.Request.URL.Query())
@@ -256,10 +271,25 @@ func (s *Server) HandleSubscribe(c *gin.Context) {
 func (s *Server) HandleUnsubscribe(c *gin.Context) {
 	logger.SdmLog.Infof("Handle Unsubscribe")
 
-	supi := c.Params.ByName("ueId")
+	// TS 29.503 6.1.3.4.2
+	// Validate SUPI and GPSI format the UE ID (SUPI or GPSI)
+	ueId := c.Params.ByName("ueId")
+	valid := validator.IsValidGpsi(ueId) || validator.IsValidSupi(ueId)
+	if !valid {
+		problemDetail := models.ProblemDetails{
+			Title:  "Malformed request syntax",
+			Status: http.StatusBadRequest,
+			Detail: "UE ID is invalid",
+			Cause:  "MANDATORY_IE_INCORRECT",
+		}
+		logger.SdmLog.Warnln("UE ID is invalid")
+		c.Set(sbi.IN_PB_DETAILS_CTX_STR, http.StatusText(int(problemDetail.Status)))
+		c.JSON(int(problemDetail.Status), problemDetail)
+		return
+	}
 	subscriptionID := c.Params.ByName("subscriptionId")
 
-	s.Processor().UnsubscribeProcedure(c, supi, subscriptionID)
+	s.Processor().UnsubscribeProcedure(c, ueId, subscriptionID)
 }
 
 // UnsubscribeForSharedData - unsubscribe from notifications for shared data
@@ -273,6 +303,25 @@ func (s *Server) HandleUnsubscribeForSharedData(c *gin.Context) {
 // Modify - modify the subscription
 func (s *Server) HandleModify(c *gin.Context) {
 	var sdmSubsModificationReq models.SdmSubsModification
+
+	// TS 29.503 6.1.3.4.2
+	// Validate SUPI and GPSI format the UE ID (SUPI or GPSI)
+	ueId := c.Params.ByName("ueId")
+	valid := validator.IsValidGpsi(ueId) || validator.IsValidSupi(ueId)
+	if !valid {
+		problemDetail := models.ProblemDetails{
+			Title:  "Malformed request syntax",
+			Status: http.StatusBadRequest,
+			Detail: "UE ID is invalid",
+			Cause:  "MANDATORY_IE_INCORRECT",
+		}
+		logger.SdmLog.Warnln("UE ID is invalid")
+		c.Set(sbi.IN_PB_DETAILS_CTX_STR, http.StatusText(int(problemDetail.Status)))
+		c.JSON(int(problemDetail.Status), problemDetail)
+		return
+	}
+	subscriptionID := c.Params.ByName("subscriptionId")
+
 	requestBody, err := c.GetRawData()
 	if err != nil {
 		problemDetail := models.ProblemDetails{
@@ -303,10 +352,7 @@ func (s *Server) HandleModify(c *gin.Context) {
 
 	logger.SdmLog.Infof("Handle Modify")
 
-	supi := c.Params.ByName("ueId")
-	subscriptionID := c.Params.ByName("subscriptionId")
-
-	s.Processor().ModifyProcedure(c, &sdmSubsModificationReq, supi, subscriptionID)
+	s.Processor().ModifyProcedure(c, &sdmSubsModificationReq, ueId, subscriptionID)
 }
 
 // ModifyForSharedData - modify the subscription
@@ -433,9 +479,24 @@ func (s *Server) HandleGetIdTranslationResult(c *gin.Context) {
 
 	logger.SdmLog.Infof("Handle GetIdTranslationResultRequest")
 
-	gpsi := c.Params.ByName("ueId")
+	// TS 29.503 6.1.3.12.2
+	// Validate SUPI and GPSI format the UE ID (SUPI or GPSI)
+	ueId := c.Params.ByName("ueId")
+	valid := validator.IsValidGpsi(ueId) || validator.IsValidSupi(ueId)
+	if !valid {
+		problemDetail := models.ProblemDetails{
+			Title:  "Malformed request syntax",
+			Status: http.StatusBadRequest,
+			Detail: "UE ID is invalid",
+			Cause:  "MANDATORY_IE_INCORRECT",
+		}
+		logger.SdmLog.Warnln("UE ID is invalid")
+		c.Set(sbi.IN_PB_DETAILS_CTX_STR, http.StatusText(int(problemDetail.Status)))
+		c.JSON(int(problemDetail.Status), problemDetail)
+		return
+	}
 
-	s.Processor().GetIdTranslationResultProcedure(c, gpsi)
+	s.Processor().GetIdTranslationResultProcedure(c, ueId)
 }
 
 func (s *Server) HandleGetMultipleIdentifiers(c *gin.Context) {