spooder 4.2.17 → 4.2.18

package/README.md

@@ -716,6 +716,9 @@ server.route('/api/endpoint', async (req, url) => {
 
 	try {
 		const json = await req.json();
+		if (json === null || typeof json !== 'object' || Array.isArray(json))
+			return 400;
+
 		// do something with json.
 		return 200;
 	} catch (err) {
@@ -735,6 +738,9 @@ server.route('/api/endpoint', validate_req_json(async (json, req, url) => {
 
 This behaves the same as the code above, where a `400` status code is returned if the `Content-Type` header is not `application/json` or if the request body is not valid JSON, and no error is thrown.
 
+> [!NOTE]
+> While arrays and other primitives are valid JSON, `validate_req_json` will only pass objects to the handler, since they are the most common use case for JSON request bodies and it removes the need to validate that in the handler. If you need to use arrays or other primitives, either box them in an object or provide your own validation.
+
 <a id="api-routing-directory-serving"></a>
 ## API > Routing > Directory Serving
 

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "spooder",
 	"type": "module",
-	"version": "4.2.17",
+	"version": "4.2.18",
 	"exports": {
 		".": {
 			"bun": "./src/api.ts",

package/src/api.ts

@@ -398,7 +398,7 @@ type ErrorHandler = (err: Error, req: Request, url: URL) => Resolvable<Response>
 type DefaultHandler = (req: Request, status_code: number) => HandlerReturnType;
 type StatusCodeHandler = (req: Request) => HandlerReturnType;
 
-type JSONRequestHandler = (req: Request, url: URL, json: JsonSerializable) => HandlerReturnType;
+type JSONRequestHandler = (req: Request, url: URL, json: JsonObject) => HandlerReturnType;
 
 type ServerSentEventClient = {
 	message: (message: string) => void;
@@ -451,7 +451,13 @@ export function validate_req_json(JSONRequestHandler: JSONRequestHandler): Reque
 			if (req.headers.get('Content-Type') !== 'application/json')
 				return 400; // Bad Request
 
-			return JSONRequestHandler(req, url, await req.json());
+			const json = await req.json();
+
+			// validate json is a plain object
+			if (json === null || typeof json !== 'object' || Array.isArray(json))
+				return 400; // Bad Request
+
+			return JSONRequestHandler(req, url, json);
 		} catch (e) {
 			return 400; // Bad Request
 		}