[BUG] Reject malformed JSON object trailing commas at the HTTP boundary #130

New issue

Open

opened 2026-08-27 14:38:02 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-27 14:38:02 +00:00

(Migrated from github.com)

Defect

Current master at immutable starting commit 52948721d8981e9aa5ccad4efd77185e52af845b accepts at least one malformed RFC 8259 JSON object shape with a trailing member comma at parse-json-octets instead of rejecting it as HTTP 400 / malformed_json.

This is a data-integrity/security boundary bug, not a feature request.

TDD entry gate — already RED

Evidence-only PR #126 preserves the smallest deterministic regression.

test head: a2368ba58d0347af8f85efd85aba7b021ded65b5
starting master: 52948721d8981e9aa5ccad4efd77185e52af845b
failing suite result: HTTP-BOUNDARY-TESTS discovered=31 executed=31 passed=30 failed=1 skipped=0
failing test: TRAILING-COMMA-JSON-IS-A-400-CLIENT-ERROR
observed behavior: object input ending in ,} is accepted; the expected http-input-error is NIL
control: [1,] is already rejected, so do not over-generalize the defect to arrays
exact-head workflow state on #126: Smoke is intentionally RED on this regression; Container Stack, Canonical StarIntel schema lock, and Operational salvage are green

Preserve the RED regression unchanged. Do not xfail, skip, weaken, swallow, or bypass it.

Governance / ADARD gate

Authoritative research transaction: lost-rob0t/starintel-auto-research#142, canonical identity STAR-RESEARCH-060 Strict JSON HTTP Boundary after resolving prior numeric collisions.

The research is now durably published on Auto-Research main. PR #142 merged as 50b0d6ad70da54af1420943b1f137b0a78e09b58; canonical approval metadata was then corrected on main at dd01622f2e1acbafb7d929f824167492b7bef0e8 using adard.research-approval.v1. The exact-head Org-roam Pages workflow for dd01622... completed successfully.

Operator research approval remains PENDING. Publication, merge and green publication CI are not approval evidence. Implementation therefore remains blocked.

Required sequence:

DONE — publish/reconcile STAR-RESEARCH-060 onto starintel-auto-research/main with adard.research-approval.v1 metadata and research approval still PENDING;
explicit operator research approval;
canonical ADARD design + adversarial review;
explicit operator design approval;
implement against current master without weakening the RED test;
exact-head unit/Nix/container/security verification;
reconcile implementation evidence back to Auto-Research main.

Required design scope once research is approved

enumerate every caller-controlled HTTP JSON parsing seam from current source;
define one strict syntax boundary before schema/business side effects;
define duplicate-key policy for authority-sensitive fields;
preserve UTF-8, body-size, nesting, numeric, correlation-ID, authorization, durable-outbox, CouchDB revision-safety, and target-fencing invariants;
prove rejected malformed input cannot mutate CouchDB, outbox state, RabbitMQ work, credentials/users, targets, or leases;
keep valid canonical JSON wire-compatible.

Architecture boundaries

This bug does not authorize unrelated storage/query changes. Preserve the StarIntel split between CouchDB/document query semantics and the graph/KB plane; do not use this parser fix as a reason to move document/query responsibility into tek9.

Refs #126, #105.

## Defect Current `master` at immutable starting commit `52948721d8981e9aa5ccad4efd77185e52af845b` accepts at least one malformed RFC 8259 JSON object shape with a trailing member comma at `parse-json-octets` instead of rejecting it as HTTP 400 / `malformed_json`. This is a data-integrity/security boundary bug, not a feature request. ## TDD entry gate — already RED Evidence-only PR #126 preserves the smallest deterministic regression. - test head: `a2368ba58d0347af8f85efd85aba7b021ded65b5` - starting `master`: `52948721d8981e9aa5ccad4efd77185e52af845b` - failing suite result: `HTTP-BOUNDARY-TESTS discovered=31 executed=31 passed=30 failed=1 skipped=0` - failing test: `TRAILING-COMMA-JSON-IS-A-400-CLIENT-ERROR` - observed behavior: object input ending in `,}` is accepted; the expected `http-input-error` is NIL - control: `[1,]` is already rejected, so do not over-generalize the defect to arrays - exact-head workflow state on #126: Smoke is intentionally RED on this regression; Container Stack, Canonical StarIntel schema lock, and Operational salvage are green Preserve the RED regression unchanged. Do not xfail, skip, weaken, swallow, or bypass it. ## Governance / ADARD gate Authoritative research transaction: `lost-rob0t/starintel-auto-research#142`, canonical identity `STAR-RESEARCH-060 Strict JSON HTTP Boundary` after resolving prior numeric collisions. The research is now durably published on Auto-Research `main`. PR #142 merged as `50b0d6ad70da54af1420943b1f137b0a78e09b58`; canonical approval metadata was then corrected on `main` at `dd01622f2e1acbafb7d929f824167492b7bef0e8` using `adard.research-approval.v1`. The exact-head Org-roam Pages workflow for `dd01622...` completed successfully. Operator research approval remains **PENDING**. Publication, merge and green publication CI are not approval evidence. Implementation therefore remains blocked. Required sequence: 1. **DONE** — publish/reconcile `STAR-RESEARCH-060` onto `starintel-auto-research/main` with `adard.research-approval.v1` metadata and research approval still PENDING; 2. explicit operator research approval; 3. canonical ADARD design + adversarial review; 4. explicit operator design approval; 5. implement against current `master` without weakening the RED test; 6. exact-head unit/Nix/container/security verification; 7. reconcile implementation evidence back to Auto-Research `main`. ## Required design scope once research is approved - enumerate every caller-controlled HTTP JSON parsing seam from current source; - define one strict syntax boundary before schema/business side effects; - define duplicate-key policy for authority-sensitive fields; - preserve UTF-8, body-size, nesting, numeric, correlation-ID, authorization, durable-outbox, CouchDB revision-safety, and target-fencing invariants; - prove rejected malformed input cannot mutate CouchDB, outbox state, RabbitMQ work, credentials/users, targets, or leases; - keep valid canonical JSON wire-compatible. ## Architecture boundaries This bug does not authorize unrelated storage/query changes. Preserve the StarIntel split between CouchDB/document query semantics and the graph/KB plane; do not use this parser fix as a reason to move document/query responsibility into tek9. Refs #126, #105.