Strange beheviour of page /country/getstatesbycountryid

Hello,

1. nop commerce version: 4.50.3 with and without source code (we are running few instances for few different web sites)
2. Expected behavior: web site should not raise exception message when navigate to /country/getstatesbycountryid
3. Actual behavior: error message Value cannot be null. (Parameter 'countryId')
4. Steps to reproduce the problem
  - install nop commerce 4.50.3 with Sample Data.
  - try to open URL http://YOUDOMAIN.AZ/country/getstatesbycountryid
5. Any private modifications you made to your nopCommerce
yes, but it doesn't affect this issue and issue occure even in original code


This strange error I see in Admin Logs. We are not using any states, no such in our country (Latvia).
Not sure from where this link is coming.
Referrer URL: empty value

Currently we have the same issue with two of our web stores (one already up and running online, second still cooking).

Question: in short, what causing it and how to fix it?


Full error message:
System.ArgumentNullException: Value cannot be null. (Parameter 'countryId')
   at Nop.Web.Factories.CountryModelFactory.GetStatesByCountryIdAsync(String countryId, Boolean addSelectStateItem)
   at Nop.Web.Controllers.CountryController.GetStatesByCountryId(String countryId, Boolean addSelectStateItem)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|20_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Nop.Services.Authentication.AuthenticationMiddleware.InvokeAsync(HttpContext context)
   at StackExchange.Profiling.MiniProfilerMiddleware.Invoke(HttpContext context) in C:\projects\dotnet\src\MiniProfiler.AspNetCore\MiniProfilerMiddleware.cs:line 121
   at WebMarkupMin.AspNetCore6.WebMarkupMinMiddleware.ProcessAsync(HttpContext context, Boolean useMinification, Boolean useCompression)
   at WebMarkupMin.AspNetCore6.WebMarkupMinMiddleware.ProcessAsync(HttpContext context, Boolean useMinification, Boolean useCompression)
   at WebMarkupMin.AspNetCore6.WebMarkupMinMiddlewareBase.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)
   at Nop.Services.Installation.InstallUrlMiddleware.InvokeAsync(HttpContext context, IWebHelper webHelper)
   at Nop.Services.Common.KeepAliveMiddleware.InvokeAsync(HttpContext context, IWebHelper webHelper)
   at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.InvokeCore(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)

This route is not intended for public use unless you (or a third-party theme/plugin) have customized this behavior and is always used with "countryId" parameter, so such errors should not be.

Also, make sure path "/country/getstatesbycountryid" is under "Disallow" section in robots.txt file so search engines don't visit this page.

RomanovM wrote:
1. we don't have any third-part theme/plugins
2. only out-of-the-box plugins installed, and most of them are being disabled, because they are doesn't applicable for us. originally has been installed version 4.40.x. and then we did upgrade to 4.50.x

RomanovM wrote:
3. yes, it's included by default and still in place


Additional stack trace:

Nop.Web.Factories.CountryModelFactory.GetStatesByCountryIdAsync(string countryId, bool addSelectStateItem) in CountryModelFactory.cs

            /// A task that represents the asynchronous operation
            /// The task result contains the list of identifiers and names of states and provinces
            /// </returns>
            public virtual async Task<IList<StateProvinceModel>> GetStatesByCountryIdAsync(string countryId, bool addSelectStateItem)
            {
                if (string.IsNullOrEmpty(countryId))

                    throw new ArgumentNullException(nameof(countryId));

                var country = await _countryService.GetCountryByIdAsync(Convert.ToInt32(countryId));
                var states = (await _stateProvinceService
                    .GetStateProvincesByCountryIdAsync(country?.Id ?? 0, (await _workContext.GetWorkingLanguageAsync()).Id))
                    .ToList();
                var result = new List<StateProvinceModel>();

Nop.Web.Controllers.CountryController.GetStatesByCountryId(string countryId, bool addSelectStateItem) in CountryController.cs

            [CheckAccessPublicStore(true)]
            //ignore SEO friendly URLs checks
            [CheckLanguageSeoCode(true)]
            /// <returns>A task that represents the asynchronous operation</returns>
            public virtual async Task<IActionResult> GetStatesByCountryId(string countryId, bool addSelectStateItem)
            {

                var model = await _countryModelFactory.GetStatesByCountryIdAsync(countryId, addSelectStateItem);

                
                return Json(model);
            }
            
            #endregion
        }



Real web site URL: https://intema.lv/en/

Last 3 queries before error:

exec sp_executesql N'SELECT TOP (@take)
  [c_1].[Id],
  [c_1].[ShippingAddress_Id],
  [c_1].[BillingAddress_Id],
  [c_1].[RegisteredInStoreId],
  [c_1].[LastActivityDateUtc],
  [c_1].[LastLoginDateUtc],
  [c_1].[CreatedOnUtc],
  [c_1].[LastIpAddress],
  [c_1].[SystemName],
  [c_1].[IsSystemAccount],
  [c_1].[Deleted],
  [c_1].[Active],
  [c_1].[CannotLoginUntilDateUtc],
  [c_1].[FailedLoginAttempts],
  [c_1].[RequireReLogin],
  [c_1].[HasShoppingCartItems],
  [c_1].[VendorId],
  [c_1].[AffiliateId],
  [c_1].[IsTaxExempt],
  [c_1].[AdminComment],
  [c_1].[EmailToRevalidate],
  [c_1].[Email],
  [c_1].[Username],
  [c_1].[CustomerGuid]
FROM
  [Customer] [c_1]
WHERE
  [c_1].[CustomerGuid] = @customerGuid
ORDER BY
  [c_1].[Id]
',N'@take int,@customerGuid uniqueidentifier',@take=1,@customerGuid='851C3F25-B301-4B51-A7F4-183CD3506341'

Return 0 record

exec sp_executesql N'SELECT
  [cr].[Id],
  [cr].[PurchasedWithProductId],
  [cr].[DefaultTaxDisplayTypeId],
  [cr].[OverrideTaxDisplayType],
  [cr].[EnablePasswordLifetime],
  [cr].[SystemName],
  [cr].[IsSystemRole],
  [cr].[Active],
  [cr].[TaxExempt],
  [cr].[FreeShipping],
  [cr].[Name]
FROM
  [CustomerRole] [cr]
    INNER JOIN [Customer_CustomerRole_Mapping] [crm] ON [cr].[Id] = [crm].[CustomerRole_Id]
WHERE
  [crm].[Customer_Id] = @Id AND [cr].[Active] = 1
',N'@Id int',@Id=1022

Return 0 record

exec sp_executesql N'SELECT
  [ga].[Id],
  [ga].[CreatedOrUpdatedDateUTC],
  [ga].[StoreId],
  [ga].[Value],
  [ga].[Key],
  [ga].[KeyGroup],
  [ga].[EntityId]
FROM
  [GenericAttribute] [ga]
WHERE
  [ga].[EntityId] = @entityId AND [ga].[KeyGroup] = @keyGroup
',N'@entityId int,@keyGroup nvarchar(400)',@entityId=1022,@keyGroup=N'Customer'

0 record as well, and then Internal Error occure

I don't see how such an error is possible on a default clean installation. All requests on this route are used with a "countryId" parameter.
In any case, apart from writing to the log, this error doesn't lead to any impacts. If you don't want to see this error in the logs and you have access to the code, replace these lines here

if (string.IsNullOrEmpty(countryId))
    throw new ArgumentNullException(nameof(countryId));

with these

if (string.IsNullOrEmpty(countryId))
    return new List<StateProvinceModel>();