-
-
Couldn't load subscription status.
- Fork 126
Description
Description and expected behavior
The ZenStackMiddleware from @zenstackhq/server/express should not throw an unhandled error if malformed JSON is received in a query parameter.
When using ZenStackMiddleware for express, the generated openapi router does not wrap calls to JSON.parse in a try/catch, which causes an express server to completely crash unless the entire middleware is wrapped in a try/catch.
Thus if using the middleware out of the box, the server can be crashed by doing things such as this:
GET <host>/openapi/user/findUnique?q={"where":"""} or any sort of string for q that would cause JSON.parse to error.
Environment (please complete the following information):
"@zenstackhq/openapi": "^1.0.0-alpha.87",
"@zenstackhq/runtime": "^1.0.0-alpha.87",
"@zenstackhq/server": "^1.0.0-alpha.87",
"zenstack": "^1.0.0-alpha.87"
"prisma": "^4.11.0",
"@prisma/client": "^4.11.0"
v18.15.0
PostgreSQL 15