Correctness: Chat handler uses #[serde(default)] silently masking missing required fields #99

New issue

Open

opened 2026-05-11 13:49:52 +00:00 by thabeta · 0 comments

thabeta commented

2026-05-11 13:49:52 +00:00

Owner

Severity: Medium

Location

crates/hero_aibroker_services/src/services/hero/types.rs and wire format handlers

Finding

Many request types use #[serde(default)] on fields that should be required:

#[derive(Deserialize)]
pub struct ChatRequest {
    pub model: String,
    #[serde(default)]
    pub messages: Vec<Message>,  // defaults to empty vec
    #[serde(default)]
    pub stream: bool,
    // ...
}

An empty messages array is silently accepted and forwarded to the provider, which will likely reject it.

Recommendation

Validate required fields explicitly before forwarding
Return 400 Bad Request with specific field errors
Don't use #[serde(default)] on semantically-required fields

## Severity: Medium ## Location `crates/hero_aibroker_services/src/services/hero/types.rs` and wire format handlers ## Finding Many request types use `#[serde(default)]` on fields that should be required: ```rust #[derive(Deserialize)] pub struct ChatRequest { pub model: String, #[serde(default)] pub messages: Vec<Message>, // defaults to empty vec #[serde(default)] pub stream: bool, // ... } ``` An empty `messages` array is silently accepted and forwarded to the provider, which will likely reject it. ## Recommendation - Validate required fields explicitly before forwarding - Return 400 Bad Request with specific field errors - Don't use `#[serde(default)]` on semantically-required fields