HarperFast / HarperFast/harper

Over-deep JSON insert returns a misleading "missing operation" 400 (secure-json-parse stack overflow)

Open
#1,292 0 comments 0 reactions 0 assignees View on GitHub
area:rest-api bug
Dominant language
JavaScript
Stars
89
Forks
10
Avg merge
2d 6h
Merged PRs (30d)
200

Description

## Summary
An insert whose JSON body is very deeply nested (~5000 levels) is rejected with:

```
HTTP 400 "Request body must include an 'operation' property."
```

…even though `operation: "insert"` **is** present at the top level. The real cause is the recursive `secure-json-parse` (4.1.0) prototype-pollution-filter walk overflowing the stack in the Fastify body-parse layer, *before* the record encoder is reached. The 400 then misattributes the failure to a missing field.

A depth ceiling is defensible, but the error text is wrong/confusing and the limit is undocumented. For reference, ≤1000-level nesting round-trips byte-exact and the record encoder (msgpackr/structon) itself never errors — this is purely an HTTP ingest-parse limit, identical on RocksDB and LMDB.

## Suggestion
Catch the parse-depth overflow and return a clear error ("request JSON nesting too deep", 413/422), and/or document the max ingest nesting depth.

## Repro
`integrationTests/qa-scratch/payload-nesting.test.ts`

---
_Found via the exploratory QA campaign (qa-explorer), scenario QA-042. Harper `001bf7b9c` (v5.1.0, main)._

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.