Repository navigation
feat: bodyReaders option (0.5.1) - #2
Conversation
…ated-body check (0.5.1) - `bodyReaders: ['readJsonBody']` checks a wrapper like readBody, including calls with a type argument (`readJsonBody<Input>(event)`). - A reader's own definition line is not reported. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
PR #2 — feat: bodyReaders option (0.5.1) — review Nice, focused change: the Two small things I noticed in
Assessment: mergeable, no conflicts, CI still running (test 22/24 queued, Socket alert check in progress). Risk level "high" is mostly procedural — no approvals yet and it touches I won't merge anything without an explicit go — want me to keep an eye on CI and squash-merge once green, or leave it for human review? |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0032cd4d8c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| export const unvalidatedReadBody = check('Unvalidated readBody', function* (ctx) { | ||
| const readers = ['readBody', ...(ctx.options?.bodyReaders ?? [])].join('|') | ||
| // `readJsonBody<Input>(event)`: an optional type argument sits between the name and the call | ||
| const call = `(?:<[^>]*>)?\\s*\\(` |
There was a problem hiding this comment.
When a configured reader is called with a common nested type such as readJsonBody<Partial<Input>>(event) or readJsonBody<Array<Input>>(event), [^>]* stops at the inner closing bracket and the remaining > prevents the regex from matching. The unvalidated body therefore passes the gate, despite the feature explicitly supporting type arguments.
Useful? React with 👍 / 👎.
| const PARSED = /safeParse\s*\(|\.parse\s*\(/ | ||
|
|
||
| export const unvalidatedReadBody = check('Unvalidated readBody', function* (ctx) { | ||
| const readers = ['readBody', ...(ctx.options?.bodyReaders ?? [])].join('|') |
There was a problem hiding this comment.
Because each configured name is interpolated as regex syntax, a valid JavaScript identifier containing $, such as read$JsonBody, becomes an end-of-input anchor and its calls are never checked. Other regex metacharacters can change matching or make construction throw; escape each configured name before joining the alternatives.
Useful? React with 👍 / 👎.
| // the reader's own definition (`function readJsonBody<T>(`) is not a call | ||
| const READ_BODY = new RegExp(`(?<!function\\s+)\\b(${readers})\\s*${call}`) |
There was a problem hiding this comment.
The definition guard only recognizes declarations containing the function keyword, so a configured reader declared with TypeScript method syntax, such as async readJsonBody<T>(event: H3Event) {, is treated as an invocation and reported. This creates an unavoidable gate failure for class/object methods and interface method signatures even though no request body is read on that line.
Useful? React with 👍 / 👎.
1 participant
Lets an app declare its own request-body readers (for example a size-capped
readJsonBody). The unvalidated-body check then requires their result to be.parse()d, likereadBody.readJsonBody<Input>(event)) are matched.Verified on an app that uses
readJsonBody: 0.5.1 + config gives a cleanfullgate, and an unparsedreadJsonBodycall is reported.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.