Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

bug: malformed JSON passed to --document (and other body object flags) silently passes validation

オープン
  • 何か問題がありますか？
#699 コメント 1 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@margaretjgu がすでに取り組んでいます。

2026年10月2日 から。

  • #717 @margaretjgu による — オープン

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
74/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
typescript
領域
cli

調査の方向性

Start in src/factory.ts around the object-flag parsing near line 609 and schema relaxation near line 700. Reproduce the elastic stack es index command with the malformed --document value, then trace how JSON.parse failures reach validation. Done means the command reports an input_validation_failed error for invalid JSON and exits 1 instead of printing a successful dry-run payload.

索引モデルが issue の本文から書いたものです。

説明

bug

Description

Running the following command reports success for inputs that are valid, but the JSON is malformed:

elastic stack es index \
  --index test-idx \
  --document '{"name":"Alice"invalid}' \
  --dry-run

The command exits 0 and prints the resolved request payload without any validation error, even though {"name":"Alice"invalid} is not valid JSON.

Root cause

There are two cooperating bugs in src/factory.ts.

Bug 1 — silent catch in object-flag parsing (≈ line 609)

When a CLI flag is typed as object and JSON.parse fails, the catch block silently falls back to storing the raw string:

} else if (arg.type === 'object') {
  try {
    const parsed = JSON.parse(raw as string)
    cliInput[arg.schemaKey] = parsed
    ...
  } catch {
    // If JSON parse fails, pass the raw value - handles schema-less fields
    // that accept plain strings (e.g. connector update-error --error)
    cliInput[arg.schemaKey] = raw   // ← malformed JSON stored as string
  }
}

The comment's rationale ("schema-less fields that accept plain strings") does not apply to --document, which is explicitly typed as object in the Elasticsearch index API schema. There is no connector update-error command in the current codebase, so the comment appears stale.

Bug 2 — schema relaxed to {} before AJV validation (≈ line 700)

Even if Bug 1 were fixed and the raw string reached validation, the validator would still accept it because body fields with type === 'object' have their JSON Schema replaced with {} (accept anything) before AJV runs:

const relaxFields = schemaArgs.filter(
  (a) =>
    sortParsedKeys.has(a.schemaKey) ||
    (a.foundIn === 'body' && (a.type === 'object' || a.type === 'array'))
)
// ...
props[f.schemaKey] = {}   // ← accepts any value, including a malformed-JSON string

The relaxation exists to avoid false positives for complex Elasticsearch DSL bodies (e.g. query, _source), but it also suppresses the type error introduced by Bug 1.

Proposed fix

Fix Bug 1: When JSON.parse throws for an object-typed flag, emit an input_validation_failed error immediately instead of falling back to the raw string. The silent fallback was added for a use case that no longer exists.

Fix Bug 2 (optional / complementary): The schema relaxation for body object fields is a blunt instrument. A narrower approach would be to only relax fields that come from user-provided structured DSL (e.g. query, aggs), not scalar-like fields such as document. In the short term, fixing Bug 1 is sufficient to surface the error before validation is reached.

Expected behaviour

elastic stack es index --index test-idx --document '{"name":"Alice"invalid}' --dry-run
# Error: --document: invalid JSON: ...
# exit 1

Actual behaviour

Command exits 0 and prints the dry-run payload as if the input were valid.

authored by Pi Coding Agent (Claude Sonnet 4.5)

主要言語
TypeScript
スター
47
フォーク
27
平均マージ
2日 6時間
マージ済み PR（30日）
52

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

elastic/cli のほかの issue

elastic/cli の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。