UNPKG

fastify

Version:

Fast and low overhead web framework, for Node.js

fastify.dev

fastify/fastify

51 lines (38 loc) • 3.23 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
## 19:37 UTC — Task ### What went wrong - Continued initiating tool work after the tool-budget warning instead of stopping to assess the existing evidence. - Started a test command that was aborted, leaving the primitive-coercion fix unverified. - Investigated Ajv internals and custom compiler compatibility without first isolating the exact failing repository behavior. - Did not establish regression coverage for missing schemaEnv handling and root primitive coercion before changing direction. ### How it was fixed - Honor soft tool-budget and interruption signals immediately; stop browsing and provide a bounded reflection. - Run only the single highest-value targeted test before the budget limit, then report if execution is blocked. - Reproduce root primitive coercion with the repository’s actual validatorCompiler path rather than relying on Ajv internals alone. - Add focused tests covering custom validator compilation, schemaEnv availability, and root primitive coercion. ## 20:03 UTC — Task ### What went wrong - Root primitive request values were validated without a parent reference, so Ajv coercion changed only its local value and left request.body as a string. - Test command output was misread: Borp ran the broader suite despite a specific file argument, making targeted coverage unclear. ### How it was fixed - Pass request and parameter metadata as Ajv parentData/parentDataProperty so root coercions update the original request value. - Add a regression test asserting quoted numeric JSON becomes a number in the handler while out-of-range values remain rejected. - Verify targeted test execution separately from the full suite to avoid mistaking aggregate counts for focused coverage. ## 20:06 UTC — Task ### What went wrong - Ajv was called with a primitive root value without parentData context, so coerced values were not written back to request.body. - The regression scenario was initially vulnerable because the handler received string "10" after validation accepted it. - The CVSS rating assumed PR:L without repository evidence that authentication is required; many affected routes may be unauthenticated. - The impact rating was stated as application-dependent without defining the affected endpoint’s actual confidentiality and integrity consequences. ### How it was fixed - Pass parentData and parentDataProperty to Ajv validators so root primitive coercions update the request object. - Retain the direct-call path for validators without schemaEnv to avoid changing non-Ajv validator behavior. - Add a regression test asserting quoted numeric JSON reaches the handler as number 10. - Determine PR from the deployed route’s authentication requirements; use PR:N for unauthenticated endpoints. - Base C/I impact on the specific handler and data affected rather than assigning a universal Fastify score. ## 20:09 UTC — Task ### What went wrong - Validation coerced a root primitive but failed to preserve the coerced value for the caller. - The regression scenario was not covered by existing tests. ### How it was fixed - Updated `lib/validation.js` to retain and return coerced root values. - Added `test/fix-root-primitive-coercion.test.js` to prevent recurrence.