Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

bug: malformed JSON passed to --document (and other body object flags) silently passes validation

已关闭
  • 哪里不对？
#699 1 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@margaretjgu 已经在做这个了。

开始于 2026年10月2日。

  • #717 来自 @margaretjgu —— 未关闭

评估

难度
3/5
预计耗时
1-2 天
新手友好度
74/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
typescript
领域
cli

调研方向

Start in src/factory.ts around the object-flag parsing near line 609 and schema relaxation near line 700. Reproduce the elastic stack es index command with the malformed --document value, then trace how JSON.parse failures reach validation. Done means the command reports an input_validation_failed error for invalid JSON and exits 1 instead of printing a successful dry-run payload.

由索引模型根据 Issue 内容生成。

描述

bug

Description

Running the following command reports success for inputs that are valid, but the JSON is malformed:

elastic stack es index \
  --index test-idx \
  --document '{"name":"Alice"invalid}' \
  --dry-run

The command exits 0 and prints the resolved request payload without any validation error, even though {"name":"Alice"invalid} is not valid JSON.

Root cause

There are two cooperating bugs in src/factory.ts.

Bug 1 — silent catch in object-flag parsing (≈ line 609)

When a CLI flag is typed as object and JSON.parse fails, the catch block silently falls back to storing the raw string:

} else if (arg.type === 'object') {
  try {
    const parsed = JSON.parse(raw as string)
    cliInput[arg.schemaKey] = parsed
    ...
  } catch {
    // If JSON parse fails, pass the raw value - handles schema-less fields
    // that accept plain strings (e.g. connector update-error --error)
    cliInput[arg.schemaKey] = raw   // ← malformed JSON stored as string
  }
}

The comment's rationale ("schema-less fields that accept plain strings") does not apply to --document, which is explicitly typed as object in the Elasticsearch index API schema. There is no connector update-error command in the current codebase, so the comment appears stale.

Bug 2 — schema relaxed to {} before AJV validation (≈ line 700)

Even if Bug 1 were fixed and the raw string reached validation, the validator would still accept it because body fields with type === 'object' have their JSON Schema replaced with {} (accept anything) before AJV runs:

const relaxFields = schemaArgs.filter(
  (a) =>
    sortParsedKeys.has(a.schemaKey) ||
    (a.foundIn === 'body' && (a.type === 'object' || a.type === 'array'))
)
// ...
props[f.schemaKey] = {}   // ← accepts any value, including a malformed-JSON string

The relaxation exists to avoid false positives for complex Elasticsearch DSL bodies (e.g. query, _source), but it also suppresses the type error introduced by Bug 1.

Proposed fix

Fix Bug 1: When JSON.parse throws for an object-typed flag, emit an input_validation_failed error immediately instead of falling back to the raw string. The silent fallback was added for a use case that no longer exists.

Fix Bug 2 (optional / complementary): The schema relaxation for body object fields is a blunt instrument. A narrower approach would be to only relax fields that come from user-provided structured DSL (e.g. query, aggs), not scalar-like fields such as document. In the short term, fixing Bug 1 is sufficient to surface the error before validation is reached.

Expected behaviour

elastic stack es index --index test-idx --document '{"name":"Alice"invalid}' --dry-run
# Error: --document: invalid JSON: ...
# exit 1

Actual behaviour

Command exits 0 and prints the dry-run payload as if the input were valid.

authored by Pi Coding Agent (Claude Sonnet 4.5)

主要语言
TypeScript
星标
49
派生
27
平均合并
1 天 23 小时
30 天内合并 PR
67

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

elastic/cli 的其他 Issue

查看 elastic/cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。