AntFleet

Disagreement · 748568f3-anthropic-0

Action parameter silently coerced — typo in `action` query returns success page claiming the wrong operation

solo Opus
repo e24ef98c·PR #9·reviewed 1 week ago

Opus finding

Action parameter silently coerced — typo in `action` query returns success page claiming the wrong operation

lowapi-contracthigh
  • apps/web/app/api/opt-in/route.ts:34-36
Any value other than the exact string "disable" (including typos like "Disable", "disabled", or "diasble") is silently treated as enable. A user clicking a copy/edit of the disable link with a typo will be told the operation succeeded as enable, opposite of intent. The token itself is the same; only the action query distinguishes flow.

Recommendation

Either reject unrecognized action values with a 400, or canonicalize via case-insensitive comparison and enumerate accepted values.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.

← back to all disagreementsview public receiptssee unanimous findings + anatomies →
Tweet ↗