fix(security): authenticate exchange JSON media type and bytes

[seonghobae]

Purpose

Close the /exchange request-body trust boundary before JSON parsing or credential work. A POST carrying bytes must use the exact application/json media type, be valid UTF-8, remain within the existing 8 KiB streamed limit, and contain at most one escape-equivalent top-level target_repository member.

Exact identities

• protected/live base: e684597212e2379f97c39548ad8a9563edd6a079
• original RED head: 0c20aa0379b6e566a54ad1bb3e201800614590f2
• current GREEN head: fbcac6936a6e56c26d56a9712ab230f73b5305e3
• branch: fix/exchange-json-media-type-boundary

GREEN implementation

The request boundary now:

• leaves non-POST and bodyless POST requests to the existing route contract;
• canonicalizes only the media-type token before ; parameters and accepts exactly application/json;
• returns 415 before body consumption for absent or different media types when a POST body exists;
• preserves the streamed byte limit and best-effort reader cancellation on overflow;
• validates the complete bounded byte sequence with a fatal UTF-8 decoder before duplicate-key scanning;
• rebuilds the Request without a stale Content-Length header;
• emits bounded no-store/nosniff JSON errors and structured rejection telemetry;
• documents the 415 response in openapi.json;
• adds route, direct-function, malformed UTF-8, parameter/case normalization, and OpenAPI regression coverage.

The boundary intentionally does not accept application/*+json, form media types, or body sniffing. Callers either omit the optional body or send the documented JSON representation.

Restack and verification boundary

The branch was merged with protected main after #272 and #266 integrated the current package/audit and Node-24 artifact-upload baselines. The new merge tree overlays only the five reviewed PR paths on current protected-main bytes.

Prior old-head evidence—126 application test files / 1063 tests, 100% owned production statement/branch/function/line coverage, reviewer-ci success, and protected-base Security Scan success—does not transfer because that application run later failed on the now-remediated predecessor nanoid audit. Application ci, reviewer-ci, protected-base-eligible Security Scan, and fresh review must all complete successfully on unchanged current head fbcac6936a6e56c26d56a9712ab230f73b5305e3 before merge.

No content sniffing, request-body relaxation, credential-path bypass, audit waiver, protection bypass, version bump, release, or deployment claim.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 91 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d956f1c8-76cd-40fd-92a9-fe314d76a4aa

📥 Commits

Reviewing files that changed from the base of the PR and between e684597 and fbcac69.

📒 Files selected for processing (5)

• openapi.json
• src/entrypoint.ts
• test/exchange-body-limit.test.ts
• test/exchange-json-integrity.test.ts
• test/openapi-contract.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact current head fbcac6936a6e56c26d56a9712ab230f73b5305e3 against protected base e684597212e2379f97c39548ad8a9563edd6a079. Verify media-type parsing, bodyless behavior, malformed UTF-8 handling, streamed size enforcement, duplicate-key ordering, request reconstruction, response/OpenAPI consistency, and unchanged credential path. Do not transfer conclusions from predecessor heads.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 50 minutes and 48 seconds before sending another message.