Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
| // DO NOT change variable name unless you change it in the sentry-docs GHA workflow in getsentry/sentry-api-schema. | ||
| const SENTRY_API_SCHEMA_SHA = 'd218ebe064fe5ec8cb383688e80cbf36c0a6a5e8'; | ||
| const SENTRY_API_SCHEMA_SHA = 'f717816f21d3ebecdb8971bcdbdaaf3322a6fdd6'; | ||
|
|
There was a problem hiding this comment.
Bug: The code fetches an external API schema without validating the HTTP response or the data's structure, which could cause a runtime crash if the schema is unavailable or malformed.
Severity: HIGH
Suggested Fix
Before parsing the JSON with response.json(), add a check to ensure the fetch was successful by verifying response.ok. Additionally, consider adding structural validation (e.g., using a schema validation library like Zod) to the parsed data to ensure required properties like tags and paths exist before they are accessed. Wrap the data fetching and parsing logic in a try...catch block to handle potential errors gracefully.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: src/build/resolveOpenAPI.ts#L12
Potential issue: The function that fetches the OpenAPI schema does not validate the HTTP
response before attempting to parse it as JSON. If the new schema SHA
(`f717816f21d3ebecdb8971bcdbdaaf3322a6fdd6`) is incorrect or the file is otherwise
unavailable, GitHub could return a 404 or 500 error. The code would then try to parse
the non-JSON error page, causing a crash. Additionally, the code assumes the presence of
specific properties like `tags` and `paths` in the parsed data. If the new schema
version changes its structure, accessing these properties will result in a runtime
`TypeError`. Since callers do not handle these errors, this would crash the build
process or the application at runtime.
Did we get this right? 👍 / 👎 to inform future reviews.
No description provided.