sveltejs / sveltejs/kit

Expose invalid request body in `handleValidationError` hook function arguments

Open
#15,697 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
20.8k
Forks
2.3k
Avg merge
1d 16h
Merged PRs (30d)
156

Description

Describe the problem

I'm not sure if the current behavior is intended or not, so I'm just filing this under a feature request.

Essentially, I've implemented the handleValidationError hook such that every invalid/malformed request to the remote function API endpoint gets reported to Sentry as a possible indicator of attack since it's very likely that someone is messing with that code:

export const handleValidationError: HandleValidationError = ({ issues, event }) => {
	// send indicator of attack to Sentry

	return {
		message: 'Bad Request'
	};
};

That works fine. However the issues is that I cannot read the request body using await event.request.json() because I get the following error:

TypeError: Body is unusable: Body has already been read
    at consumeBody (node:internal/deps/undici/undici:6896:31)
    at _Request.json (node:internal/deps/undici/undici:6847:18)
...

I suspect that this is due to SvelteKit already reading the request body before trying to validate it and pass it to the relevant remote function. As expected, event.request.bodyUsed is set to true.

I'm not aware of any other way that would allow me to read the request body (which I'd then need to decode from Base64 anyway). I feel like it's pretty important to be able to do so, to be able to discern between a bug (or a stale app version in the browser) and someone potentially probing the app for vulnerabilities.

Describe the proposed solution

The higher-order SvelteKit code passes the invalid request body to the handleValidationError handler function, as a parameter, alongside issues and event. To make it even cleaner, that data could perhaps even already be decoded from Base64.

Alternatives considered

I also tried to use await event.request.text(), getRequestEvent() and event.request.body, but they naturally all suffer from the same issues.

Importance

would make my life easier

Additional Information

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the handleValidationError hook and the remote function API request-validation path described in the issue. Trace where the request body is consumed before issues and event are passed to the handler. Done means the handler receives the invalid request body, with its expected encoding or decoding behavior defined and covered by the relevant validation tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.