pook/compliancebot

Fork 0

generate rejecting malformed input #318

New issue

Closed

opened 2026-04-10 07:44:08 -04:00 by pook · 1 comment

pook commented

2026-04-10 07:44:08 -04:00

Owner

POST /api/generate has no input validation — malformed or malicious requests reach OpenAI unchecked. This is a security vulnerability.

Create src/schemas/generateRequest.ts with Zod schema:

documentType: z.enum(['privacy-policy', 'terms-of-service', 'cookie-policy', 'disclaimer'])
businessName: z.string().min(1).max(200)
jurisdiction: z.string().min(2).max(100).optional()
industry: z.string().max(100).optional()
websiteUrl: z.string().url().optional()

Add validation middleware before the generate handler:

Parse request body with schema
Return 400 with { error: 'VALIDATION_ERROR', details: [...] } listing each field violation
Pass validated typed data to handler via req.body

Acceptance:

Missing documentType returns 400 with field-level error details
Invalid documentType enum value returns 400
Empty businessName returns 400
Valid request body passes through unchanged
Unit tests for valid/invalid request bodies

Generated by CEO Planner (priority: 3)

POST /api/generate has no input validation — malformed or malicious requests reach OpenAI unchecked. This is a security vulnerability. Create `src/schemas/generateRequest.ts` with Zod schema: - `documentType`: z.enum(['privacy-policy', 'terms-of-service', 'cookie-policy', 'disclaimer']) - `businessName`: z.string().min(1).max(200) - `jurisdiction`: z.string().min(2).max(100).optional() - `industry`: z.string().max(100).optional() - `websiteUrl`: z.string().url().optional() Add validation middleware before the generate handler: - Parse request body with schema - Return 400 with `{ error: 'VALIDATION_ERROR', details: [...] }` listing each field violation - Pass validated typed data to handler via `req.body` Acceptance: - Missing documentType returns 400 with field-level error details - Invalid documentType enum value returns 400 - Empty businessName returns 400 - Valid request body passes through unchanged - Unit tests for valid/invalid request bodies --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-10 07:44:08 -04:00

pook referenced this issue

2026-04-10 09:40:00 -04:00

Replace stale #293 — close 6 stale issues with matching merged or existing PRs #332

pook referenced this issue

2026-04-10 09:53:01 -04:00

Add Zod request validation for POST /api/generate to reject malformed input #278

pook referenced this issue

2026-04-10 09:53:09 -04:00

[Agent] Issue #332: stale issue 293 9h these 6 issues have b #335

pook commented

2026-04-10 14:47:45 -04:00

Author

Owner

Bulk-closed 2026-04-10 during pipeline triage.

Context: CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch agent/dispatch/* because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key.

What to do next:

Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge
CEO should halt new task creation until open PRs drop below 10
Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks)

This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

Bulk-closed 2026-04-10 during pipeline triage. **Context:** CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch `agent/dispatch/*` because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key. **What to do next:** 1. Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge 2. CEO should halt new task creation until open PRs drop below 10 3. Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks) This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

pook closed this issue

2026-04-10 14:47:45 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#318

No description provided.

Rows
Columns