Bug: JSON.parse without error handling in request body parsing #4711
Description
🐛 Bug Report
Severity: High
Category: Error Handling / DoS
Location: src/request.ts
Found by: WhiteRose - AI-powered bug hunter
Bug ID: WR-014
📋 Description
JSON.parse() is called without try-catch blocks in request body parsing. Malformed JSON causes uncaught exceptions and crashes the application.
🔍 Vulnerable Code
// src/request.ts
const body = await this.raw.text()
const parsed = JSON.parse(body) // ❌ No error handling!💥 Impact
- Application crashes: Malformed JSON = unhandled exception
- DoS attacks: Attacker sends invalid JSON to crash server
- Poor error messages: Users don't get helpful validation errors
🧪 Attack Example
curl -X POST http://api.example.com/data \
-H "Content-Type: application/json" \
-d "{invalid json here}"Result: Server crashes with SyntaxError: Unexpected token
✅ Suggested Fix
Wrap JSON.parse() in try-catch:
async json<T = unknown>(): Promise<T> {
const body = await this.raw.text()
try {
return JSON.parse(body)
} catch (e) {
throw new HTTPException(400, {
message: 'Invalid JSON in request body',
cause: e,
})
}
}🔗 References
- WhiteRose: https://github.com/shakecodeslikecray/whiterose
- CWE-754: Improper Check for Unusual or Exceptional Conditions
Found automatically by WhiteRose AI bug hunter - helping make open source more secure 🛡️