Skip to content

fix: validate numeric request parameters strictly - #346

Open
winklemad wants to merge 2 commits into
cloudflare:mainfrom
winklemad:fix/strict-number-parameter-coercion
Open

fix: validate numeric request parameters strictly#346
winklemad wants to merge 2 commits into
cloudflare:mainfrom
winklemad:fix/strict-number-parameter-coercion

Conversation

@winklemad

Copy link
Copy Markdown

Summary

  • Validate numeric query, path, and header parameters as complete signed decimal values, including decimal fractions and exponent notation.
  • Reject partially numeric values, empty or whitespace-only values, and hexadecimal, binary, or octal inputs instead of silently coercing them.
  • Add endpoint-level regressions covering accepted and rejected parameter values across query, path, and header inputs.

Changes

  • Replace prefix-based parsing with an anchored decimal-number check before numeric conversion.
  • Add a patch changeset for the stricter request-parameter behavior.

Tests

  • npm test -- parameters.test.ts
  • npm test
  • npm run build
  • npm run lint
  • npx changeset status

Related context

Related context: #139 and #151

@winklemad
winklemad requested a review from G4brym as a code owner July 22, 2026 16:57
@pkg-pr-new

pkg-pr-new Bot commented Jul 22, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/chanfana@346

commit: 750c6b9

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant