Repository navigation
Note content and tools are barely validated on PATCH /note and POST /note #313
Description
Problem
PATCH /note/:notePublicId and POST /note barely validate Editor.js content and the tools list:
- the body schemas only check that
contentis an object:blocksis optional, its items are not described, andtoolsis not in the schema at all; NoteService.validateNoteToolschecks that every block type is listed intools, but not that the tool ids exist or match the tool names;- block
datais not checked anywhere.
Reproduction
Requests through fastify.inject() on the current code:
| Request | Response |
|---|---|
PATCH with content: {} |
500 Cannot read properties of undefined (reading 'map') |
PATCH without tools |
500, same error |
PATCH with a block { type: 'header' } (no id, no data) |
500 Cannot read properties of undefined (reading 'length') |
POST /note without content |
500 Cannot read properties of undefined (reading 'map') |
PATCH with a nonexistent tool id { name: 'header', id: '99999' } |
200, saved |
PATCH with header bound to the paragraph tool id |
200, saved |
PATCH with a header block data: { level: 9, foo: [1] } |
200, saved |
Malformed bodies should get 400 instead of 500, and notes should not be saved with tools that don't exist or don't match, or with block data the tool doesn't expect.
Suggested fix
- Describe the body in the route schemas:
content.blocksas a required array of{ id: string, type: string, data: object, tunes?: object },toolsas a required array of{ name: string, id: string }. - In
validateNoteTools, compare the tools found by id with the passed ones: every id exists and its name matches. - Optionally, validate
dataof the default tools (paragraph,header,list) and keep data of other tools free-form.
The MCP server from #309 writes notes through PATCH /note. Its input schemas check the block structure, but not data.
Activity