Skip to content

fix(project): reject empty/whitespace-only --name in create and update#36

Open
lxcario wants to merge 1 commit into
TestSprite:mainfrom
lxcario:fix/project-name-whitespace
Open

fix(project): reject empty/whitespace-only --name in create and update#36
lxcario wants to merge 1 commit into
TestSprite:mainfrom
lxcario:fix/project-name-whitespace

Conversation

@lxcario

@lxcario lxcario commented Jun 25, 2026

Copy link
Copy Markdown

What

testsprite project create and project update accept a whitespace-only --name (e.g. --name " ") and send it to the backend verbatim, creating a blank-named project.

Why this matters

A whitespace-only name produces a junk project record that's effectively unidentifiable in project list and the dashboard. The sibling test create already rejects this input, so the two write paths behave inconsistently for the same kind of value.

Reproduction

# project create — whitespace name is ACCEPTED (exit 0), would be sent as "   "
$ testsprite project create --type frontend --name "   " --url http://example.com --dry-run --output json
{
  "id": "p_dryrun_2026",
  "type": "frontend",
  "name": "   ",
  ...
}

# control: an EMPTY name is correctly rejected (exit 5)
$ testsprite project create --type frontend --name "" --url http://example.com --dry-run
Error: --name is required        # exit 5

# sibling `test create` — whitespace name is correctly rejected (exit 5)
$ testsprite test create --project proj_1 --type frontend --name "   " --code-file x.ts --dry-run --output json
{ "error": { "code": "VALIDATION_ERROR", "nextAction": "Flag `--name` is invalid: is required." } }   # exit 5

Root cause

src/commands/project.ts. The command action validates the name with if (!cmdOpts.name), which a whitespace-only string passes (a non-empty string is truthy), and runCreate / runUpdate only check the upper length bound:

if (opts.name !== undefined && opts.name.length > 200) {
  throw localValidationError('--name must be at most 200 characters');
}

There is no lower-bound / whitespace check, so " " flows straight into the request body.

Fix

Reject empty / whitespace-only names in both runCreate and runUpdate, before the existing length checks:

if (opts.name !== undefined && opts.name.trim().length === 0) {
  throw localValidationError('--name must not be empty or whitespace-only');
}

This mirrors the existing requireString whitespace guard in src/lib/validate.ts that test create already uses (added as "dogfood P1 fix #1" to stop junk records reaching the backend) — the project path just wasn't going through it.

Tests

Added 2 tests to src/commands/project.test.ts (one for runCreate, one for runUpdate) asserting a whitespace-only --name rejects with VALIDATION_ERROR / exit 5 and makes no network call. Both fail on main before this fix and pass after.

  • Before (main): Tests 16 failed | 1359 passed | 72 skipped
  • After (this branch): Tests 16 failed | 1361 passed | 72 skipped (+2 new tests)

The 16 failures are pre-existing and environment-specific (Windows path/line-ending), unrelated to this change — see #4.

Verification

  • npm test: same 16 pre-existing (environment-specific) failures as baseline, zero new
  • npm run typecheck: pass
  • npm run lint: pass

project create/update validated --name with the action handler's if (!name) check, which a whitespace-only string passes (a non-empty string is truthy). The blank name was then sent verbatim, creating a junk-named project. The sibling 	est create already rejects this via the requireString whitespace guard (dogfood P1 fix TestSprite#1); this aligns project create/update with that behavior. Adds 2 regression tests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Video asset

1 participant