These accepted any JSON type on both POST and PATCH, silently mangled
into Python repr() strings at save time (a dict became the literal text
"{'a': 1}", unparseable as JSON) - and the immediate response echoed the
raw pre-save value, while a later GET returned the mangled one, an
internally inconsistent API.
Added validate_string_fields(), rejecting non-string values with 400
before they reach save(), matching #005's approach for tags. Verified live
and with new tests.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| 001-csrf-behind-reverse-proxy.md | ||
| 002-env-example-not-actually-loaded.md | ||
| 003-model-max-length-silently-unenforced.md | ||
| 004-html-fragment-content-not-validated-server-side.md | ||
| 005-patch-silently-mishandles-invalid-input.md | ||
| 006-failed-post-still-evicts-artifacts.md | ||
| 007-handover-to-llm-test-2026-09-02.md | ||
| 008-source-fields-untyped-and-mangled.md | ||
| 010-concurrent-posts-race-past-quota.md | ||
| README.md | ||
Issues
One file per issue: NNN-short-slug.md, numbered sequentially. Each file
has a title, status (Open / Fixed / By design), description, and resolution
once closed.