HarperFast / HarperFast/harper
Over-deep JSON insert returns a misleading "missing operation" 400 (secure-json-parse stack overflow)
- Dominant language
- JavaScript
- Stars
- 89
- Forks
- 10
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 200
Description
## Summary
An insert whose JSON body is very deeply nested (~5000 levels) is rejected with:
```
HTTP 400 "Request body must include an 'operation' property."
```
…even though `operation: "insert"` **is** present at the top level. The real cause is the recursive `secure-json-parse` (4.1.0) prototype-pollution-filter walk overflowing the stack in the Fastify body-parse layer, *before* the record encoder is reached. The 400 then misattributes the failure to a missing field.
A depth ceiling is defensible, but the error text is wrong/confusing and the limit is undocumented. For reference, ≤1000-level nesting round-trips byte-exact and the record encoder (msgpackr/structon) itself never errors — this is purely an HTTP ingest-parse limit, identical on RocksDB and LMDB.
## Suggestion
Catch the parse-depth overflow and return a clear error ("request JSON nesting too deep", 413/422), and/or document the max ingest nesting depth.
## Repro
`integrationTests/qa-scratch/payload-nesting.test.ts`
---
_Found via the exploratory QA campaign (qa-explorer), scenario QA-042. Harper `001bf7b9c` (v5.1.0, main)._
Contributor guide
Assessment
This issue has not been assessed yet.