Skip to content

@zenstackhq/server: malformed JSON in query string for openapi requests crashes middleware #300

@potion-cellar

Description

@potion-cellar

Description and expected behavior
The ZenStackMiddleware from @zenstackhq/server/express should not throw an unhandled error if malformed JSON is received in a query parameter.

When using ZenStackMiddleware for express, the generated openapi router does not wrap calls to JSON.parse in a try/catch, which causes an express server to completely crash unless the entire middleware is wrapped in a try/catch.

Thus if using the middleware out of the box, the server can be crashed by doing things such as this:

GET <host>/openapi/user/findUnique?q={"where":"""} or any sort of string for q that would cause JSON.parse to error.

Environment (please complete the following information):

"@zenstackhq/openapi": "^1.0.0-alpha.87",
"@zenstackhq/runtime": "^1.0.0-alpha.87",
"@zenstackhq/server": "^1.0.0-alpha.87",
"zenstack": "^1.0.0-alpha.87"

"prisma": "^4.11.0",
"@prisma/client": "^4.11.0"

v18.15.0

PostgreSQL 15

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions