Skip to content

fix: validate price_id field rejects non-Stripe formats #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Washio20 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: validate price_id field rejects non-Stripe formats #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7320,7 +7320,8 @@
"price_id": {
"type": "string",
"nullable": true,
"description": "Stripe price ID for billing purposes."
"description": "Stripe price ID for billing purposes.",
"pattern": "^price_[a-zA-Z0-9_]+$"
Copy link

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.

Suggested change
"pattern": "^price_[a-zA-Z0-9_]+$"
"pattern": "^price_[a-zA-Z0-9]+$"

Copilot uses AI. Check for mistakes.
},
"status": {
"$ref": "#/components/schemas/DeviceStatus"
Expand Down Expand Up @@ -7479,7 +7480,8 @@
},
"price_id": {
"type": "string",
"nullable": true
"nullable": true,
"pattern": "^price_[a-zA-Z0-9_]+$"
Copy link

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.

Suggested change
"pattern": "^price_[a-zA-Z0-9_]+$"
"pattern": "^price_[a-zA-Z0-9]+$"

Copilot uses AI. Check for mistakes.
},
"status": {
"$ref": "#/components/schemas/DeviceStatus"
Expand Down Expand Up @@ -8255,4 +8257,4 @@
}
}
}
}
}
2 changes: 2 additions & 0 deletions openapi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5787,6 +5787,7 @@ components:
type: string
nullable: true
description: Stripe price ID for billing purposes.
pattern: ^price_[a-zA-Z0-9_]+$
Copy link

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.

Suggested change
pattern: ^price_[a-zA-Z0-9_]+$
pattern: ^price_[a-zA-Z0-9]+$

Copilot uses AI. Check for mistakes.
status:
$ref: '#/components/schemas/DeviceStatus'
metadata:
Expand Down Expand Up @@ -5970,6 +5971,7 @@ components:
price_id:
type: string
nullable: true
pattern: ^price_[a-zA-Z0-9_]+$
Comment on lines 5972 to +5974
Copy link

@coderabbitai coderabbitai bot Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate openapi.json
json_file=$(fd -a '^openapi\.json$' . || true)
if [[ -z "${json_file}" ]]; then
  echo "openapi.json not found"
  exit 1
fi

echo "=== Found openapi.json at: $json_file ==="
echo ""

# Show price_id entries and patterns for DeviceUpdate in openapi.json
echo "=== Searching for DeviceUpdate in openapi.json ==="
rg -n '"DeviceUpdate"' "$json_file" -C3 || echo "No DeviceUpdate found"
echo ""

echo "=== Searching for price_id in openapi.json ==="
rg -n '"price_id"' "$json_file" -C3 || echo "No price_id found"
echo ""

echo "=== Searching for price_ pattern in openapi.json ==="
rg -n 'price_[a-zA-Z0-9_]+' "$json_file" -C2 || echo "No price_ pattern found"

Repository: stayforge/Stayforge-API

Length of output: 8884

🏁 Script executed:

#!/bin/bash

# Check if openapi.yaml exists
if [[ ! -f openapi.yaml ]]; then
  echo "openapi.yaml not found in root"
  fd -a '^openapi\.yaml$' . || true
  exit 1
fi

# Show lines around 5972-5974 to see DeviceUpdate context
echo "=== Lines 5970-5980 of openapi.yaml ==="
sed -n '5970,5980p' openapi.yaml

# Search for DeviceUpdate schema definition
echo ""
echo "=== Searching for DeviceUpdate in openapi.yaml ==="
rg -n 'DeviceUpdate' openapi.yaml -B2 -A10 | head -50

# Confirm no price_id elsewhere in the JSON
echo ""
echo "=== File size and basic stats ==="
wc -l openapi.yaml
wc -l /home/jailuser/git/openapi.json || true

Repository: stayforge/Stayforge-API

Length of output: 1543

Regenerate openapi.json to include the price_id pattern for DeviceUpdate.

The YAML spec at lines 5972-5974 defines price_id with pattern ^price_[a-zA-Z0-9_]+$ as part of the DeviceUpdate schema, but openapi.json currently lacks both the DeviceUpdate schema and the price_id field. Regenerate the JSON spec from the updated YAML to maintain sync.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@openapi.yaml` around lines 5972 - 5974, The openapi.json is out of sync with
openapi.yaml: add the DeviceUpdate schema and its price_id field (pattern
^price_[a-zA-Z0-9_]+$) to the generated JSON; regenerate openapi.json from the
updated YAML so DeviceUpdate and price_id (with type string, nullable true, and
that pattern) are present, then commit the regenerated openapi.json to keep the
specs synchronized.

Copy link

Copilot AI Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern ^price_[a-zA-Z0-9_]+$ is overly permissive. Stripe price IDs follow the format price_ followed by alphanumeric characters only, without additional underscores. The pattern should be ^price_[a-zA-Z0-9]+$ (removing the underscore from the character class). This would correctly reject IDs like price_abc_def while still accepting valid IDs like price_1abc2def3.

Suggested change
pattern: ^price_[a-zA-Z0-9_]+$
pattern: ^price_[a-zA-Z0-9]+$

Copilot uses AI. Check for mistakes.
status:
$ref: '#/components/schemas/DeviceStatus'
metadata:
Expand Down
Loading