vincent/gerbeur
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v3: fix the backend's correctness findings — each by a rule shared across the code rather than one more special case. Link previews: readTextCapped decoded every page as UTF-8, so a Latin-1 page came out garbled unless it went through the curl fallback, which re-encoded it on its own; pages are now decoded in the charset their Content-Type or <meta> declares, and the curl fallback hands the bytes over as they are. The image proxy served and cached for a day an error answer that claimed an image type, and read a body without Content-Length whole before checking its size; it now refuses an error status and reads through the same capped reader. The icons task's Twemoji fetch gives up after 15 s instead of holding the start up, and extractLinkHref, which only its tests used, is gone. Backlinks matched a linked URL against the raw url column, so https://x.com/ missed a dump posted as https://x.com; they now compare canonical URLs, as reposts do. The four LIKE searches put the query in raw, so % and _ were wildcards and the mention search for "a_b" found "axb"; lib/like.ts escapes them. Every list query now treats a malformed row the same way, a 500 through model/rows.ts's parseRows, where ten of them silently dropped it; the playlist dumps query uses the model's column list rather than a hand-written copy, and the aliased list is derived from the plain one. The vote and like services commit through transaction() instead of their own BEGIN and ROLLBACK, which would have rolled back a caller's transaction.

Browse Source 
Validation: the dump validators refuse the nulls their shared types don't allow (a null title or note on creation, a null URL on edit); a playlist title of spaces is refused and titles are stored trimmed; usernames and emails are checked by the same USERNAME_RE and EMAIL_RE in shared/validation.ts on sign-up, on PATCH /api/users/me (which checked other limits) and in the sign-up form. Mentions are read by shared/mention.ts's mentionedUsernames, which skips code and URLs as Markdown shows them: https://mastodon.social/@bob or a `@bob` in code notified bob; the editor's suggestions derive their trigger from the same pattern instead of a copy. Following an unknown user is a 404 rather than a foreign-key 500, and following a private playlist a 404 rather than a 403 that confirmed it exists. `ws` and `emojibase` are reserved category slugs, since the server answers them before the app. GET /api/users/me no longer turns every error into a 500.

Dead code goes: adminOnlyMiddleware, verifyEmailTransport, listUsers, deleteUser with disconnectUser and the force_logout message only it sent, PATCH /api/notifications/:id/read (with markOneRead), isSlugAvailable, the unreachable 500 in fetchComment, and the `if (!ctx.state.user)` checks behind authMiddleware. 214 backend and 627 frontend tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
khannurien
2026-09-29 19:35:53 +00:00
parent 14e3ab125b
commit a36a4cac6b
45 changed files with 363 additions and 442 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
api/validators/dump.ts
View File

@@ -29,16 +29,12 @@ export function isCreateUrlDumpRequest(
!("url" in obj) || typeof obj.url !== "string"
) return false;
const o = obj as Record<string, unknown>;
if (
"comment" in o && typeof o.comment !== "string" && o.comment !== null
) return false;
if ("comment" in o && typeof o.comment !== "string") return false;
if (
typeof o.comment === "string" &&
(o.comment as string).length > VALIDATION.DUMP_COMMENT_MAX
) return false;
if ("title" in o && typeof o.title !== "string" && o.title !== null) {
return false;
}
if ("title" in o && typeof o.title !== "string") return false;
if (
typeof o.title === "string" &&
(o.title as string).length > VALIDATION.DUMP_TITLE_MAX
@@ -56,7 +52,7 @@ export function isCreateUrlDumpRequest(
export function isUpdateDumpRequest(obj: unknown): obj is UpdateDumpRequest {
if (!obj || typeof obj !== "object") return false;
const o = obj as Record<string, unknown>;
if ("url" in o && typeof o.url !== "string" && o.url !== null) return false;
if ("url" in o && typeof o.url !== "string") return false;
if ("title" in o) {
if (typeof o.title !== "string") return false;
const trimmed = (o.title as string).trim();

24
api/validators/playlist.ts
View File

@@ -11,10 +11,16 @@ import type {
} from "../../shared/playlist.ts";
import { VALIDATION } from "../../shared/validation.ts";
/** Checks that `title` isn't blank and, trimmed, fits the limit. */
function isValidTitle(title: string): boolean {
const trimmed = title.trim();
return trimmed.length > 0 && trimmed.length <= VALIDATION.PLAYLIST_TITLE_MAX;
}
/**
* Checks whether `obj` is a {@link CreatePlaylistRequest} with a title, and a
* title and description within the `VALIDATION` limits. A null description
* passes. A title of spaces passes too.
* Checks whether `obj` is a {@link CreatePlaylistRequest} with a title that
* isn't blank, and a title and description within the `VALIDATION` limits. A
* null description passes.
*/
export function isCreatePlaylistRequest(
obj: unknown,
@@ -25,10 +31,7 @@ export function isCreatePlaylistRequest(
!("isPublic" in obj) || typeof obj.isPublic !== "boolean"
) return false;
const o = obj as Record<string, unknown>;
if (
(o.title as string).length === 0 ||
(o.title as string).length > VALIDATION.PLAYLIST_TITLE_MAX
) return false;
if (!isValidTitle(o.title as string)) return false;
if (
"description" in o && typeof o.description !== "string" &&
o.description !== null
@@ -42,7 +45,7 @@ export function isCreatePlaylistRequest(
/**
* Checks whether `obj` is an {@link UpdatePlaylistRequest} whose title, if
* given, isn't empty, with a title and description within the `VALIDATION`
* given, isn't blank, with a title and description within the `VALIDATION`
* limits.
*/
export function isUpdatePlaylistRequest(
@@ -52,10 +55,7 @@ export function isUpdatePlaylistRequest(
const o = obj as Record<string, unknown>;
if ("title" in o) {
if (typeof o.title !== "string") return false;
if (
(o.title as string).length === 0 ||
(o.title as string).length > VALIDATION.PLAYLIST_TITLE_MAX
) return false;
if (!isValidTitle(o.title as string)) return false;
}
if (
"description" in o && typeof o.description !== "string" &&

18
api/validators/user.ts
View File

@@ -10,7 +10,7 @@ import {
type RegisterUserRequest,
type UpdateUserRequest,
} from "../../shared/user.ts";
import { VALIDATION } from "../../shared/validation.ts";
import { EMAIL_RE, USERNAME_RE, VALIDATION } from "../../shared/validation.ts";
/**
* Checks whether `obj` is a {@link LoginUserRequest}. It checks the types
@@ -57,15 +57,10 @@ export function validateRegisterUserRequest(obj: unknown): string | null {
!("email" in obj) || typeof obj.email !== "string"
) return "Invalid request";
const { username, password, email } = obj as RegisterUserRequest;
if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
if (!EMAIL_RE.test(email)) {
return "Invalid email address";
}
if (
!new RegExp(
`^[a-zA-Z0-9_]{${VALIDATION.USERNAME_MIN},${VALIDATION.USERNAME_MAX}}$`,
)
.test(username)
) {
if (!USERNAME_RE.test(username)) {
return `Username must be ${VALIDATION.USERNAME_MIN}–${VALIDATION.USERNAME_MAX} characters and contain only letters, numbers, or underscores`;
}
if (password.length < VALIDATION.PASSWORD_MIN) {
@@ -80,15 +75,14 @@ export function validateRegisterUserRequest(obj: unknown): string | null {
/**
* Checks whether `obj` is a valid {@link UpdateUserRequest}, for
* `PATCH /api/users/me`. Every field is optional, but each one present must be
* well-formed and within the `VALIDATION` limits. The username's limits here
* are not those of sign-up, which the route never lets it change anyway.
* well-formed and within the `VALIDATION` limits.
*/
export function isUpdateUserRequest(obj: unknown): obj is UpdateUserRequest {
if (!obj || typeof obj !== "object") return false;
const o = obj as Record<string, unknown>;
if ("username" in o) {
if (typeof o.username !== "string") return false;
if (!/^[a-zA-Z0-9_]{1,32}$/.test(o.username as string)) return false;
if (!USERNAME_RE.test(o.username as string)) return false;
}
if ("password" in o) {
if (typeof o.password !== "string") return false;
@@ -104,7 +98,7 @@ export function isUpdateUserRequest(obj: unknown): obj is UpdateUserRequest {
) return false;
if ("email" in o) {
if (typeof o.email !== "string") return false;
if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(o.email as string)) return false;
if (!EMAIL_RE.test(o.email as string)) return false;
}
if (
typeof o.description === "string" &&