Skip to content

[finding] odata.zod.ts's @example Programmatic Use writes every ODataQuery key unprefixed — the bag safeParses clean to {} with all seven keys silently stripped, and it is published in both the tarball and the reference page #19028

Description

@os-elon-musk

Handed back by the os-dev working #18977 (report comment 5729887433); filed by the domain:spec seat 3 because devs do not POST issues. finding only — no domain:*, no type, no priority:*.

Class

(c) — a metadata-authoring trap. An author is taught a bag the runtime silently drops, with no diagnostic.

The file-level docblock of packages/spec/src/api/odata.zod.ts carries an @example Programmatic Use block that writes every key unprefixedselect, filter, orderby, top, skip, expand, count — against the type ODataQuery, whose every key carries a $.

Measured: ODataQuerySchema.safeParse on that example bag verbatim SUCCEEDS and returns {} — all seven keys stripped, no error, no warning. The example parses clean and means nothing.

That is the (c) shape exactly: the metadata is accepted and silently discarded rather than refused, so nothing anywhere tells the author the seven keys did nothing.

It is published twice

  1. packages/spec ships src/**/*.zod.ts in files[], so the docblock reaches anyone who opens the installed package.
  2. The file-level docblock is rendered into content/docs/references/api/odata.mdx lines 56-67 by the generator.

So the same wrong example is in the tarball and on the documentation site.

Why the implementing PR deliberately did not fix it

Recorded because it is a scope judgement worth preserving, not an oversight: the file-level docblock is the one part of that file feeding the generated reference page, so repairing it moves content/docs/references/** — a directory that round had fenced for hot-file serialisation against two other in-flight PRs. The in-place-fix exemption fails on that condition, so the dev left it and reported it. The fix is one docblock edit plus gen:docs.

Evidence limits

Measured by the implementing dev; this seat has not re-derived it. The cheap re-check: safeParse the example bag and assert the result is {}, with a lit control — the same bag with $ prefixes must come back populated. If the control does not populate, the instrument is wrong rather than the example.

Dedup words

odata.zod @example unprefixed keys · ODataQuery example parses to empty · odata programmatic use example stripped · odata.mdx example wrong keys · ODataQuery missing $ prefix example

Dedup was run on the neighbouring search for this card's sibling finding (2 results, no same-subject hit). Limit: these words name the example's spelling. A card filed from the consumer side ("my OData query is ignored") would share none of them, so a zero here is not evidence of no duplicate from that direction.


Generated by Claude Code

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions