Validate app.bundlerOptions keys are objects in Bun.serve#30518
Validate app.bundlerOptions keys are objects in Bun.serve#30518robobun wants to merge 2 commits into
app.bundlerOptions keys are objects in Bun.serve#30518Conversation
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
Walkthrough
ChangesBundler Options Validation
🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/js/bun/http/bun-serve-args.test.ts`:
- Around line 677-690: The tests currently only assert the exception type
(toThrow(TypeError)); tighten them to assert the specific error message so
path-specific messaging is enforced: update the two expectations inside the
test.each blocks that call serve(...) to use toThrowError(...) (or
toThrowError(/regex/)) and match the exact message that your runtime now
produces (e.g. include "app.bundlerOptions" for the top-level case and
`bundlerOptions.${key}` for the per-key case) so the serve(...) validation error
text is verified rather than just its type.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5d1dbf57-ecfa-41c9-b4bd-291c5ba6762c
📒 Files selected for processing (2)
src/bake/bake.zigtest/js/bun/http/bun-serve-args.test.ts
|
This PR may be a duplicate of:
🤖 Generated with Claude Code |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| pub fn fromJS(global: *jsc.JSGlobalObject, comptime name: []const u8, js_options: JSValue) bun.JSError!BuildConfigSubset { | ||
| if (!js_options.isObject()) { | ||
| return global.throwInvalidArguments("'" ++ api_name ++ ".bundlerOptions." ++ name ++ "' must be an object", .{}); | ||
| } |
There was a problem hiding this comment.
🔴 This fix is incomplete — the nested minify option just below has the exact same bug. Bun.serve({ app: { bundlerOptions: { client: { minify: false } } } }) (or minify: 128n) still falls through to minify_options.getBooleanLoose(...) on a non-object and trips the same debugAssert(target.isObject()) this PR is fixing. The boolean guard should handle false (and non-objects should throw) before calling getBooleanLoose.
Extended reasoning...
What the bug is
This PR adds an isObject() guard at the top of BuildConfigSubset.fromJS (src/bake/bake.zig:209-211) to prevent debugAssert(target.isObject()) from firing when a non-object is passed for bundlerOptions.{server,client,ssr}. However, immediately below in the same function, the nested minify sub-option is read via getOptional(global, "minify", JSValue) and — if it isn't the boolean true — passed straight to getBooleanLoose, which has the exact same precondition.
Code path
In BuildConfigSubset.fromJS:
if (try js_options.getOptional(global, "minify", JSValue)) |minify_options| brk: {
if (minify_options.isBoolean() and minify_options.asBoolean()) {
// ... handle 'true'
break :brk;
}
if (try minify_options.getBooleanLoose(global, "whitespace")) |value| { ... }getBooleanLoose (src/jsc/JSValue.zig:1866-1868) calls this.get(global, property_name), and get() begins with bun.debugAssert(target.isObject()) (src/jsc/JSValue.zig:1534). So calling getBooleanLoose on a non-object primitive trips the same assertion this PR was opened to fix.
Why the existing guard doesn't help
The new isObject() check at line 209 validates js_options (the client/server/ssr object), but minify_options is fetched from inside it via getOptional(..., JSValue), which returns any non-null/undefined value untyped. The only guard on minify_options is isBoolean() and asBoolean(), which only short-circuits for true.
Step-by-step proof
With Bun.serve({ app: { bundlerOptions: { client: { minify: false } } } }):
js_options={ minify: false }→ passes the newisObject()check at line 209.getOptional(global, "minify", JSValue)returns the JS booleanfalse.- Guard:
minify_options.isBoolean()=true,minify_options.asBoolean()=false→true and false=false. Does notbreak :brk. - Falls through to
minify_options.getBooleanLoose(global, "whitespace"). getBooleanLoosecallsthis.get(...)→bun.debugAssert(false.isObject())→ panic in debug builds.
The same happens with minify: 128n / 5 / "str" / Symbol() (step 3: isBoolean() is false, so the AND is false, fall through). The minify: false case is particularly notable because it's a perfectly reasonable thing for a user to write.
Impact
Same fingerprint class (debugAssert target.isObject() in JSValue.get) as the crash this PR is fixing, in the very function this PR modified. The fuzzer will hit it next.
Fix
Either change the boolean guard to handle both values (if (minify_options.isBoolean()) { const b = minify_options.asBoolean(); options.minify_* = b; break :brk; }), or add an if (!minify_options.isObject()) return global.throwInvalidArguments(...) after the boolean check, mirroring what was done for js_options. The new tests should also cover { [key]: { minify: value } } for the same primitive set.
1 participant
Fuzzer found a debug assertion failure when passing non-object values for
app.bundlerOptions(or itsserver/client/ssrsub-keys) toBun.serve.getOptional(..., JSValue)returns any non-null/undefined value without type-checking, so a BigInt/number/string/etc. was passed straight intoBuildConfigSubset.fromJS, which then called.getOptional()on it and tripped theisObject()assert.Now throws a proper
TypeError: 'app.bundlerOptions.client' must be an objectinstead.Fingerprint:
e7c62943558380b8