danielgtaylor / danielgtaylor/huma

Schema validation does not respect appropriate interfaces when populating or rendering `ErrorDetail.Value`

Open
#808 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
4.4k
Forks
285
Avg merge
40m
Merged PRs (30d)
1

Description

When schema validation is performed, the `ErrorDetail.Value` property written to the `http.ResponseWriter` is a raw string representation of the value.

This behavior is unexpected when schema validation is performed on a type such as `type Secret string` which implements several common interfaces (returning a redacted placeholder instead of the raw secret to avoid leaking sensitive data) such as
- `encoding.TextMarshaler`
- `fmt.Stringer`
- `json.Marshaler`

When `ErrorDetail.Value` is populated, seeing as it is typed as `any`, it should hold the value in the same type used in the operation input struct's `Body` struct. When this is rendered out as JSON it will then respect both `encoding.TextMarshaler` & `json.Marshaler` implicitly (assuming `json.Marshal` or `json.Encoder` are used under the hood).

This would prevent responding back with raw non-redacted sensitive data that was passed in by the client in trust that it would be handled appropriately. Returning it back in plaintext (while I don't know if this poses any real security risks) looks quite bad.

I am vaguely aware of the possibility of resolvers to work around the problem but this suggestion misses the point. Standard behavior baked into the `encoding/json` package is being sidestepped here and it shouldn't be.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the schema-validation path that populates ErrorDetail.Value and the rendering path that writes it to http.ResponseWriter. Compare the current behavior with Go's encoding/json handling of custom types implementing the mentioned interfaces. Done means ErrorDetail.Value preserves the operation input type and rendered responses use its redacted marshaling behavior instead of exposing the raw value.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.