cloudflare / cloudflare/chanfana

Bug: chanfana assumes all instances of `ZodError` thrown from a route's `handle` method are 400 user request validation errors

Open
#166 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
766
Forks
70
Avg merge
25m
Merged PRs (30d)
4

Description

**Bug description**: If a route's `handle` method throws a `ZodError` that's not coming from `validateRequest`, chanfana erroneously returns 400 to the user, also exposing the route's internal implementation details in the response body.

**Desired behavior**: only errors thrown from `getValidatedData` are assumed to be a user request validation error.

**Example**:

```ts
import { fromIttyRouter, OpenAPIRoute } from 'chanfana';
import { json, Router } from 'itty-router';
import { z } from 'zod';

const schema = z.object({ hello: z.string().default('world') });

export class MyRoute extends OpenAPIRoute {
schema = {
request: {
body: {
content: {
'application/json': {
schema,
},
},
},
},
responses: {
'201': {
description: 'Return request body after validation',
content: {
'application/json': {
schema,
},
},
},
},
};

async handle() {
const data = await this.getValidatedData();

// Internal logic executed after successful user request validation
const internalSchema = z.object({ internal: z.string().max(3) });
internalSchema.parse({ internal: 'Highly senstive data' });

return json(data.body);
}
}

export default fromIttyRouter(Router()).post('/hello', MyRoute);
```

for all valid requests will always return `400 Bad Request`

```
{
"errors": [
{
"code": "invalid_type",
"expected": "string",
"message": "Required",
"path": [
"internal",
],
"received": "undefined",
},
],
"result": {},
"success": false,
}
```

Contributor guide

Open the contributing guide

Research direction

Start by tracing OpenAPIRoute.getValidatedData from the route handle method through the error handling used by fromIttyRouter. Verify that only errors from request validation produce a 400 response, while a ZodError raised by internal route logic does not expose its implementation details; add or run the relevant error-handling tests if present.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.