Bug: POST /tasks accepts whitespace-only titles

[ascerra]

Description

The POST /tasks endpoint allows creating tasks with whitespace-only titles like " " or "\t". The validation check only rejects falsy values (empty string, null, undefined) but doesn't trim whitespace.

Steps to reproduce

curl -X POST http://localhost:3000/tasks \
  -H "Content-Type: application/json" \
  -d '{"title": "   "}'

Expected behavior

Should return 400 with an error message like "title cannot be blank".

Actual behavior

Returns 201 and creates a task with a whitespace-only title.

Additional context

The same issue likely exists for the PATCH endpoint when updating a title to whitespace.

[ascerra]

/fs-triage

[fullsend-ai-triage]

Triage Summary (re-assessed)

Severity: Low | Category: Bug

Problem

The POST /tasks endpoint validates titles with if (!title), which only catches falsy values. Whitespace-only strings (e.g., " ") are truthy in JavaScript and bypass this check, allowing tasks with blank-looking titles to be created. The PATCH /tasks/:id endpoint performs no title validation at all.

Root Cause

In src/index.js, the title guard uses a simple falsy check instead of trimming whitespace first. The fix should trim whitespace before validating, e.g., if (!title || !title.trim()).

Status

PR #3 is open with a fix that addresses both POST and PATCH handlers and includes integration tests.

Recommended Fix

1. Update the POST handler's title validation to reject whitespace-only strings
2. Add equivalent title validation to the PATCH handler when updates.title is provided
3. Trim titles before storing them

Proposed Test Case

POST /tasks with '   ' → expect 400 and error message
POST /tasks with '\t' → expect 400
POST /tasks with '' → expect 400 (existing behavior preserved)
POST /tasks with null title → expect 400 (existing behavior preserved)
POST /tasks with '  valid title  ' → expect 201, title stored trimmed
PATCH /tasks/:id with whitespace-only title → expect 400
PATCH /tasks/:id with valid title → expect 200

Previous run

Triage Summary

Severity: Low | Category: Bug

Problem

The POST /tasks endpoint validates titles with if (!title), which only catches falsy values. Whitespace-only strings (e.g., " ") are truthy in JavaScript and bypass this check, allowing tasks with blank-looking titles to be created. Additionally, the PATCH /tasks/:id endpoint performs no title validation at all, as noted in your report.

Root Cause

In src/index.js, the title guard on the POST handler uses a simple falsy check. The fix should trim whitespace before validating, e.g., if (!title || !title.trim()).

Recommended Fix

1. Update the POST handler's title validation to reject whitespace-only strings
2. Add equivalent title validation to the PATCH handler when updates.title is provided
3. Consider trimming titles before storing them

Proposed Test Case

// POST /tasks with whitespace-only title → expect 400
// POST /tasks with '   ' → expect 400 and error message 'title is required' or 'title cannot be blank'
// PATCH /tasks/:id with whitespace-only title → expect 400
// POST /tasks with '  valid title  ' → expect 201 (title accepted, optionally trimmed)
// POST /tasks with '' (empty) → expect 400 (existing behavior preserved)
// POST /tasks with null title → expect 400 (existing behavior preserved)

---

Labels: This is a confirmed input validation bug in the API.

[ascerra]

/fs-code

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 5:59 PM UTC · Completed 6:01 PM UTC
Commit: 8165fcf · View workflow run →

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 6:02 PM UTC · Completed 6:03 PM UTC
Commit: 8165fcf · View workflow run →

[fullsend-ai-coder]

An open PR already addresses this issue — skipping automated implementation.

• fix(#1): reject whitespace-only titles in POST and PATCH /tasks #3 by @app/fullsend-ai-coder

To override, comment /fs-code --force on this issue.

_{Posted by fullsend pre-code check}