You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Bug description: If a route's handle method throws a ZodError that's not coming from validateRequest, chanfana erroneously returns 400 to the user, also exposing the route's internal implementation details in the response body.
Desired behavior: only errors thrown from getValidatedData are assumed to be a user request validation error.
Example:
import{fromIttyRouter,OpenAPIRoute}from'chanfana';import{json,Router}from'itty-router';import{z}from'zod';constschema=z.object({hello: z.string().default('world')});exportclassMyRouteextendsOpenAPIRoute{schema={request: {body: {content: {'application/json': {
schema,},},},},responses: {'201': {description: 'Return request body after validation',content: {'application/json': {
schema,},},},},};asynchandle(){constdata=awaitthis.getValidatedData<typeofthis.schema>();// Internal logic executed after successful user request validationconstinternalSchema=z.object({internal: z.string().max(3)});internalSchema.parse({internal: 'Highly senstive data'});returnjson(data.body);}}exportdefaultfromIttyRouter(Router()).post('/hello',MyRoute);
for all valid requests will always return 400 Bad Request
Bug description: If a route's
handle
method throws aZodError
that's not coming fromvalidateRequest
, chanfana erroneously returns 400 to the user, also exposing the route's internal implementation details in the response body.Desired behavior: only errors thrown from
getValidatedData
are assumed to be a user request validation error.Example:
for all valid requests will always return
400 Bad Request
The text was updated successfully, but these errors were encountered: