anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Unprotected JSON.parse in provider fetch wrapper can crash requests #8270

New Issue
Open
opened 2026-02-16 18:09:33 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 18:09:33 -05:00
Owner
Copy Link
Copy Source

Originally created by @riftzen-bit on GitHub (Feb 1, 2026).

Originally assigned to: @rekram1-node on GitHub.

Summary

The provider fetch wrapper contains an unprotected JSON.parse call that can crash API requests if the body is malformed.

Location

packages/opencode/src/provider/provider.ts:1010

Issue

if (model.api.npm === "@ai-sdk/openai" && opts.body && opts.method === "POST") {
  const body = JSON.parse(opts.body as string)  // NO TRY-CATCH
  const isAzure = model.providerID.includes("azure")
  // ...
}

If opts.body is not valid JSON (which shouldn't happen normally, but could due to a bug elsewhere), this will throw an unhandled error and crash the entire request.

Impact

  • Severity: Medium
  • Type: Error Handling
  • Effect: Malformed request bodies cause unhandled exceptions

Suggested Fix

Wrap in try-catch:

if (model.api.npm === "@ai-sdk/openai" && opts.body && opts.method === "POST") {
  try {
    const body = JSON.parse(opts.body as string)
    const isAzure = model.providerID.includes("azure")
    // ... rest of logic
  } catch (e) {
    // Log warning and continue with original body
    log.warn("failed to parse request body for ID stripping", { error: e })
  }
}
Originally created by @riftzen-bit on GitHub (Feb 1, 2026). Originally assigned to: @rekram1-node on GitHub. ## Summary The provider fetch wrapper contains an unprotected JSON.parse call that can crash API requests if the body is malformed. ## Location `packages/opencode/src/provider/provider.ts:1010` ## Issue ```typescript if (model.api.npm === "@ai-sdk/openai" && opts.body && opts.method === "POST") { const body = JSON.parse(opts.body as string) // NO TRY-CATCH const isAzure = model.providerID.includes("azure") // ... } ``` If `opts.body` is not valid JSON (which shouldn't happen normally, but could due to a bug elsewhere), this will throw an unhandled error and crash the entire request. ## Impact - **Severity**: Medium - **Type**: Error Handling - **Effect**: Malformed request bodies cause unhandled exceptions ## Suggested Fix Wrap in try-catch: ```typescript if (model.api.npm === "@ai-sdk/openai" && opts.body && opts.method === "POST") { try { const body = JSON.parse(opts.body as string) const isAzure = model.providerID.includes("azure") // ... rest of logic } catch (e) { // Log warning and continue with original body log.warn("failed to parse request body for ID stripping", { error: e }) } } ```
yindo commented 2026-02-16 18:09:34 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Feb 1, 2026):

This issue might be a duplicate of or closely related to existing error handling issues. Please check:

  • #11697: Missing error handling in Share API fetch calls leads to silent failures
  • #11701: Empty catch blocks silently swallow errors in config and initialization
  • #11700: Missing array bounds checking in LLM provider response handling

These are part of a broader pattern of insufficient error handling in critical code paths that deserves systematic review and fixes.

Feel free to ignore if this specific case addresses your particular scenario.

@github-actions[bot] commented on GitHub (Feb 1, 2026): This issue might be a duplicate of or closely related to existing error handling issues. Please check: - #11697: Missing error handling in Share API fetch calls leads to silent failures - #11701: Empty catch blocks silently swallow errors in config and initialization - #11700: Missing array bounds checking in LLM provider response handling These are part of a broader pattern of insufficient error handling in critical code paths that deserves systematic review and fixes. Feel free to ignore if this specific case addresses your particular scenario.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#8270
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?