fix: use consistent package parsing on social/likes#1180
fix: use consistent package parsing on social/likes#1180danielroe merged 2 commits intonpmx-dev:mainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
📝 WalkthroughWalkthroughThe changes implement consistent package parsing across social/likes endpoints. On the client side, the social likes request now encodes the package name before transmission. On the server side, the endpoint was restructured to parse the router parameter into segments, validate the decoded package name against a schema using valibot, and handle validation failures with a 502 error response. The overall fetch structure and data assembly remain unchanged, with the modifications focused on input validation and encoding consistency. Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
| try { | ||
| const { packageName } = v.parse(PackageRouteParamsSchema, { | ||
| packageName: decodeURIComponent(rawPackageName), | ||
| }) | ||
|
|
||
| const likesUtil = new PackageLikesUtils() | ||
| return await likesUtil.getLikes(packageName, oAuthSession?.did.toString()) | ||
| } catch (error: unknown) { | ||
| handleApiError(error, { | ||
| statusCode: 502, | ||
| message: 'Failed to get likes', | ||
| }) |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n server/api/social/likes/[...pkg].get.ts | head -50Repository: npmx-dev/npmx.dev
Length of output: 1211
🏁 Script executed:
rg -n "decodeURIComponent\(" server/api -C 2Repository: npmx-dev/npmx.dev
Length of output: 886
🏁 Script executed:
rg -n "createError\|handleApiError" server/api -l | head -10Repository: npmx-dev/npmx.dev
Length of output: 43
🏁 Script executed:
rg -n "import.*createError\|import.*handleApiError" server/apiRepository: npmx-dev/npmx.dev
Length of output: 43
🏁 Script executed:
cat -n server/api/registry/vulnerabilities/[...pkg].get.ts | head -40Repository: npmx-dev/npmx.dev
Length of output: 1826
🏁 Script executed:
rg -n "createError" server/ -t ts -t tsx | head -5Repository: npmx-dev/npmx.dev
Length of output: 88
🏁 Script executed:
rg -n "createError\|handleApiError" server/api/social/likes/[...pkg].get.tsRepository: npmx-dev/npmx.dev
Length of output: 43
🏁 Script executed:
rg -n "export.*handleApiError\|function handleApiError" server/Repository: npmx-dev/npmx.dev
Length of output: 43
🏁 Script executed:
fd "utils" server/ -type dRepository: npmx-dev/npmx.dev
Length of output: 231
🏁 Script executed:
fd "utils" server/ -type d | head -20Repository: npmx-dev/npmx.dev
Length of output: 231
🏁 Script executed:
rg -n "handleApiError" server/ | head -10Repository: npmx-dev/npmx.dev
Length of output: 909
🏁 Script executed:
rg -n "function handleApiError|const handleApiError" . | head -5Repository: npmx-dev/npmx.dev
Length of output: 174
🏁 Script executed:
cat -n server/utils/error-handler.tsRepository: npmx-dev/npmx.dev
Length of output: 1414
🏁 Script executed:
rg -n "createError" server/ | head -15Repository: npmx-dev/npmx.dev
Length of output: 1532
🏁 Script executed:
rg -n "URIError" server/Repository: npmx-dev/npmx.dev
Length of output: 43
🏁 Script executed:
rg -n "import.*createError" server/api/social/likes/[...pkg].get.tsRepository: npmx-dev/npmx.dev
Length of output: 43
Catch URIError from malformed percent-encoding to return 400 instead of 502.
decodeURIComponent throws URIError when given invalid percent-encoding. The current implementation funnels this to handleApiError's generic fallback, which returns 502, misclassifying a client error as a server error. Wrap the call to catch URIError separately and return a 400 status.
This pattern repeats across multiple endpoints (e.g. server/api/registry/vulnerabilities/[...pkg].get.ts), so consider applying the fix consistently.
Suggested approach
Extract decodeURIComponent outside the v.parse call to isolate the error:
try {
+ const decodedPackageName = decodeURIComponent(rawPackageName)
const { packageName } = v.parse(PackageRouteParamsSchema, {
- packageName: decodeURIComponent(rawPackageName),
+ packageName: decodedPackageName,
})
const likesUtil = new PackageLikesUtils()
return await likesUtil.getLikes(packageName, oAuthSession?.did.toString())
} catch (error: unknown) {
+ if (error instanceof URIError) {
+ throw createError({
+ status: 400,
+ message: 'invalid package name encoding',
+ })
+ }
handleApiError(error, {
statusCode: 502,
message: 'Failed to get likes',
})
}
|
Thanks for your first contribution, @BoxenOfDonuts! 💪 We'd love to welcome you to the npmx community. Come and say hi on Discord! And once you've joined, visit npmx.wamellow.com to claim the contributor role. |
2 participants
Resolves #1119