Skip to content

fix(dashboards): validate threshold JSON shape - #129434

Draft
joshuarli wants to merge 2 commits into
masterfrom
fix/dashboard-thresholds-validation
Draft

joshuarli wants to merge 2 commits into
masterfrom
fix/dashboard-thresholds-validation

Conversation

@joshuarli

Copy link
Copy Markdown
Member

Behavioral split from #129431 (cast audit).

Thresholds are stored in a JSONField and the read serializer casts unit to str and max_values to dict[str, int] without checking the stored shape. Validate at write time:

  • thresholds must be an object
  • max_values must be an object with only max1/max2 keys, integer values, and increasing values
  • unit must be a string

This makes the read-side casts backed by a validated invariant. Tests cover non-object thresholds, non-object max_values, unknown keys, non-integer values, and non-string units.

Thresholds are a JSONField, but unit and max_values were cast to their
response types without validation. Reject non-object thresholds, unknown
or non-integer maximum keys, and non-string units at write time so the
serializer's casts are backed by a validated invariant.
@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Oct 31, 2026
joshuarli added a commit to joshuarli/sentry that referenced this pull request Oct 31, 2026
Reject non-object thresholds, unknown or non-integer maximum keys, and
non-string units at write time so the serializer casts are backed by a
validated invariant.

Review split: getsentry#129434.
Keep the parametrized case table typed so the backend mypy run accepts
the new test module.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant