Skip to content

fix(channels): reject whitespace-only agentId with 400 #358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
davidmckayv merged 2 commits into from
Sep 4, 2026
Merged

fix(channels): reject whitespace-only agentId with 400 #358

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
981dd64
fix(channels): reject whitespace-only agentId with 400
Ayush7614 Sep 4, 2026
409b0a4
Merge remote-tracking branch 'origin/main' into gate358
davidmckayv Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions server/src/channels/routes.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -935,6 +935,12 @@ export function parseActivityInput(
if (object.agentId !== null && typeof object.agentId !== "string") {
return { ok: false, error: "Agent ID must be a string or null." };
}
if (
typeof object.agentId === "string" &&
object.agentId.trim().length === 0
) {
return { ok: false, error: "Agent ID must be a string or null." };
}
if (typeof object.at !== "string") {
return { ok: false, error: "Timestamp is required." };
}
Expand Down
13 changes: 13 additions & 0 deletions server/tests/channel-activity-input.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,4 +52,17 @@ describe("parsing a reported message", () => {
expect(parsed.value.text).toBe("hello");
expect(parsed.value.agentId).toBe("agent-1");
});

test("refuses a whitespace-only agent ID rather than looking it up", () => {
// " " used to trim to "" and fall through to a 404 "Agent not found";
// a malformed field is a 400 naming the field.
const parsed = parseActivityInput(
{ text: "hello", agentId: " ", at: "2026-09-03T09:00:00.000Z" },
now,
);
expect(parsed).toEqual({
ok: false,
error: "Agent ID must be a string or null.",
});
});
});