fix: validate price_id field rejects non-Stripe formats#15
fix: validate price_id field rejects non-Stripe formats#15Washio20 wants to merge 1 commit intostayforge:mainfrom
Conversation
Add regex pattern validation (^price_[a-zA-Z0-9_]+$) to the price_id field in DeviceProperties and DeviceUpdate schemas. This ensures price_id values conform to the Stripe pricing ID format, rejecting non-ASCII characters like Chinese. Closes stayforge#4 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughAdded regex pattern validation Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
openapi.yaml (1)
5786-5791:⚠️ Potential issue | 🟡 MinorRemove strict regex validation for Stripe Price IDs.
Line 5790 applies a strict pattern (
^price_[a-zA-Z0-9_]+$) to Stripe-generated Price IDs. However, Stripe's official guidance is to treat Price IDs as opaque strings and avoid parsing or validating the format beyond theprice_prefix. Stripe-generated Price IDs are not subject to the alphanumeric + hyphen/underscore restrictions that apply only to user-specified IDs. Strict validation risks rejecting valid IDs if Stripe modifies their format. Consider simplifying to just check the prefix, or removing the pattern entirely.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@openapi.yaml` around lines 5786 - 5791, The OpenAPI schema for the property price_id currently enforces a strict pattern (^price_[a-zA-Z0-9_]+$) which may reject valid Stripe-generated IDs; update the price_id schema (the price_id property) to remove the strict regex and either delete the pattern entirely or relax it to only assert the "price_" prefix (e.g., a simple prefix check like ^price_.*$) so the spec treats Stripe Price IDs as opaque strings while still optionally ensuring they start with "price_".
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@openapi.yaml`:
- Around line 5972-5974: The openapi.json is out of sync with openapi.yaml: add
the DeviceUpdate schema and its price_id field (pattern ^price_[a-zA-Z0-9_]+$)
to the generated JSON; regenerate openapi.json from the updated YAML so
DeviceUpdate and price_id (with type string, nullable true, and that pattern)
are present, then commit the regenerated openapi.json to keep the specs
synchronized.
---
Outside diff comments:
In `@openapi.yaml`:
- Around line 5786-5791: The OpenAPI schema for the property price_id currently
enforces a strict pattern (^price_[a-zA-Z0-9_]+$) which may reject valid
Stripe-generated IDs; update the price_id schema (the price_id property) to
remove the strict regex and either delete the pattern entirely or relax it to
only assert the "price_" prefix (e.g., a simple prefix check like ^price_.*$) so
the spec treats Stripe Price IDs as opaque strings while still optionally
ensuring they start with "price_".
| type: string | ||
| nullable: true | ||
| pattern: ^price_[a-zA-Z0-9_]+$ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate openapi.json
json_file=$(fd -a '^openapi\.json$' . || true)
if [[ -z "${json_file}" ]]; then
echo "openapi.json not found"
exit 1
fi
echo "=== Found openapi.json at: $json_file ==="
echo ""
# Show price_id entries and patterns for DeviceUpdate in openapi.json
echo "=== Searching for DeviceUpdate in openapi.json ==="
rg -n '"DeviceUpdate"' "$json_file" -C3 || echo "No DeviceUpdate found"
echo ""
echo "=== Searching for price_id in openapi.json ==="
rg -n '"price_id"' "$json_file" -C3 || echo "No price_id found"
echo ""
echo "=== Searching for price_ pattern in openapi.json ==="
rg -n 'price_[a-zA-Z0-9_]+' "$json_file" -C2 || echo "No price_ pattern found"Repository: stayforge/Stayforge-API
Length of output: 8884
🏁 Script executed:
#!/bin/bash
# Check if openapi.yaml exists
if [[ ! -f openapi.yaml ]]; then
echo "openapi.yaml not found in root"
fd -a '^openapi\.yaml$' . || true
exit 1
fi
# Show lines around 5972-5974 to see DeviceUpdate context
echo "=== Lines 5970-5980 of openapi.yaml ==="
sed -n '5970,5980p' openapi.yaml
# Search for DeviceUpdate schema definition
echo ""
echo "=== Searching for DeviceUpdate in openapi.yaml ==="
rg -n 'DeviceUpdate' openapi.yaml -B2 -A10 | head -50
# Confirm no price_id elsewhere in the JSON
echo ""
echo "=== File size and basic stats ==="
wc -l openapi.yaml
wc -l /home/jailuser/git/openapi.json || trueRepository: stayforge/Stayforge-API
Length of output: 1543
Regenerate openapi.json to include the price_id pattern for DeviceUpdate.
The YAML spec at lines 5972-5974 defines price_id with pattern ^price_[a-zA-Z0-9_]+$ as part of the DeviceUpdate schema, but openapi.json currently lacks both the DeviceUpdate schema and the price_id field. Regenerate the JSON spec from the updated YAML to maintain sync.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@openapi.yaml` around lines 5972 - 5974, The openapi.json is out of sync with
openapi.yaml: add the DeviceUpdate schema and its price_id field (pattern
^price_[a-zA-Z0-9_]+$) to the generated JSON; regenerate openapi.json from the
updated YAML so DeviceUpdate and price_id (with type string, nullable true, and
that pattern) are present, then commit the regenerated openapi.json to keep the
specs synchronized.
There was a problem hiding this comment.
Pull request overview
This pull request adds regex pattern validation to the price_id field in device schemas to ensure values conform to the Stripe pricing ID format. The change addresses an issue where the field previously accepted any Unicode characters, including non-Latin characters that are invalid for Stripe price IDs.
Changes:
- Added pattern validation (
^price_[a-zA-Z0-9_]+$) toDeviceProperties.price_idandDeviceUpdate.price_id - Updated both
openapi.yamlandopenapi.jsonto maintain consistency
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| openapi.yaml | Added regex pattern validation to price_id field in DeviceProperties schema (line 5790) and DeviceUpdate schema (line 5974) |
| openapi.json | Added regex pattern validation to price_id field in DeviceProperties schema (line 7324) and DeviceUpdate schema (line 7484) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| type: string | ||
| nullable: true | ||
| description: Stripe price ID for billing purposes. | ||
| pattern: ^price_[a-zA-Z0-9_]+$ |
There was a problem hiding this comment.
The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.
| pattern: ^price_[a-zA-Z0-9_]+$ | |
| pattern: ^price_[a-zA-Z0-9]+$ |
| price_id: | ||
| type: string | ||
| nullable: true | ||
| pattern: ^price_[a-zA-Z0-9_]+$ |
There was a problem hiding this comment.
The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.
| pattern: ^price_[a-zA-Z0-9_]+$ | |
| pattern: ^price_[a-zA-Z0-9]+$ |
| "nullable": true, | ||
| "description": "Stripe price ID for billing purposes." | ||
| "description": "Stripe price ID for billing purposes.", | ||
| "pattern": "^price_[a-zA-Z0-9_]+$" |
There was a problem hiding this comment.
The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.
| "pattern": "^price_[a-zA-Z0-9_]+$" | |
| "pattern": "^price_[a-zA-Z0-9]+$" |
| "type": "string", | ||
| "nullable": true | ||
| "nullable": true, | ||
| "pattern": "^price_[a-zA-Z0-9_]+$" |
There was a problem hiding this comment.
The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.
| "pattern": "^price_[a-zA-Z0-9_]+$" | |
| "pattern": "^price_[a-zA-Z0-9]+$" |
Summary
^price_[a-zA-Z0-9_]+$) to theprice_idfield in device schemasRoot Cause
The
price_idfield had no format validation, allowing any Unicode characters (including Chinese characters likepricdee二hly) to be accepted despite being intended for Stripe pricing IDs.Changes
DeviceProperties.price_id: Addedpattern: ^price_[a-zA-Z0-9_]+$DeviceUpdate.price_id: Addedpattern: ^price_[a-zA-Z0-9_]+$openapi.yamlandopenapi.jsonTesting
pricdee二hly) will now be rejected with a 422 errorprice_1abc2def3) continue to workCloses #4
🤖 Generated with Claude Code
Summary by CodeRabbit