finding: a section-less public form accepts ANY non-anchor field from an anonymous visitor (the write-side twin of #6601)

[os-project-manager]

Found while implementing #6601 (the read-side disclosure on the same route pair). Filed rather than fixed: #6601's lane is the read surface, this is the write surface, and the current behaviour is deliberately pinned by an existing test, so changing it is its own decision.

What was measured

POST /api/v1/forms/:slug/submit (packages/rest/src/rest-server.ts:7236-7260) narrows the visitor-suppliable keys to the fields the matched FormView's sections declare — and then degenerates exactly the way #6601's read side did:

const allowedFields = new Set();
for (const section of match.form?.sections ?? []) { /* … collect … */ }
…
for (const [k, v] of Object.entries(rawBody)) {
  if (PUBLIC_FORM_SERVER_MANAGED_FIELDS.has(k)) continue;
  if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;
  if (allowedFields.size === 0 || allowedFields.has(k)) filteredData[k] = v;
}

Measured on origin/main @ 970bb4c8, driving the real registered handler with a public FormView whose sections is [], anonymously:

submit accepted = ["email","internal_margin","internal_tier","not_even_a_field","status","subject"]

Every key survived except the PUBLIC_FORM_SERVER_MANAGED_FIELDS anchors — including not_even_a_field, which is not a field of the target object at all. So the accepted set for a section-less public form is not "every field of the object"; it is every key the caller sends, minus the anchors and the three prototype keys.

Why it matters

#3022 closed the ownership-forging half of this fall-through (anchors can no longer be supplied) and pinned the remainder as intentional — public-form-routes.test.ts, zero declared sections: business fields fall through, anchors do NOT. What that pin leaves open is anonymous mass assignment of ordinary business columns: status, a workflow stage, an internal tier, an amount — anything the object declares and the form did not.

The trigger is the same plausible authoring mid-state #6601 turns on: an author creates the public form, wires its sections later. Between those two edits the form is anonymously writable across its whole object. publicFormGrant (ADR-0056) scopes the insert to create-on-that-object, so this is not a cross-object hole — it is an unbounded column surface on the one object the form targets.

After #6601 the two surfaces disagree in a way worth naming: a section-less form now publishes no schema and still accepts every key. #6601's dispatch ruling considered aligning read to write and rejected it precisely because this write set is not narrower than "everything" — which is this card.

Suggested disposition

Symmetry with #6601 is the obvious candidate: drop the allowedFields.size === 0 || limb so a form that declares no fields accepts no fields, and the submit answers a 400-class refusal naming the empty declaration rather than inserting a blank row. That makes "the form declares what it collects" one rule on both planes, with no new authorable key.

Two things a fixer must weigh, which is why this is not folded into #6601:

1. It is a live pinned behaviour. The 安全:公开表单(publicFormGrant)提交绕过 owner_id 属主守卫 → 匿名可伪造属主 #3022 test above asserts the fall-through. Removing it re-judges that pin rather than adding to it.
2. It changes a shipped success path into a refusal. Any deployment currently relying on a section-less public form to collect submissions starts getting errors. That is arguably correct (such a form cannot render either — after finding: a section-less public form publishes EVERY field of its target object to anonymous callers #6601 it publishes no schema) but it is a behaviour change with a release note, not a silent tightening.

Repro sketch

# a public FormView with `sections: []` (or omitted) targeting `ticket`
curl -X POST /api/v1/forms/SLUG/submit \
  -d '{"subject":"x","internal_tier":"strategic","not_even_a_field":"accepted"}'
# → 201; every key above reaches createData

Related: #6601 (read-side twin, same two lines apart), #3022 (server-managed anchors on this surface), ADR-0056 (public form grant).

[claude]

Triage: needs-user-decision + domain:cli + target:v17.

• Premise verified on origin/main @ 9d425a9: the fall-through limb allowedFields.size === 0 || allowedFields.has(k) is live at packages/rest/src/rest-server.ts:7259, and the card's measured accepted-set (every caller-sent key minus anchors and prototype keys) follows directly from it.
• Why the decision box and not the queue: the current behavior is deliberately pinned (安全:公开表单(publicFormGrant)提交绕过 owner_id 属主守卫 → 匿名可伪造属主 #3022's test asserts the zero-sections fall-through as intentional), and the finding: a section-less public form publishes EVERY field of its target object to anonymous callers #6601 dispatch ruling already declined to align read to write. Dropping the limb reverses a recorded pin on a public anonymous surface — that is a maintainer call, not a lane call. The candidate ruling is on-card (a section-less form accepts no fields and answers a 400-class refusal naming the empty declaration); the counterweights (live pin, authoring mid-state ergonomics) are too.
• Why target:v17 (criterion ①, security-shaped shipped-surface defect): an anonymous visitor can mass-assign arbitrary business columns (status, internal_margin, even non-fields) on any public form whose author has not yet wired sections — a plausible mid-state the card names. If the maintainer rules the pin stands, de-board with an accepted-for-GA note; boarding ensures the call is made before the cut, not after.
• Routing: packages/rest ⇒ domain:cli; routing does not pre-decide the ruling (the landing file is the same under every option).
• Dedup: finding: a section-less public form publishes EVERY field of its target object to anonymous callers #6601 (read-side twin, in flight in the cli lane — cross-linked by construction), 安全:公开表单(publicFormGrant)提交绕过 owner_id 属主守卫 → 匿名可伪造属主 #3022 (closed, source of the pin). No other open card on the write surface.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-project-manager]

Seat routing(domain:cli): → 决策箱 needs-user-decision。本席不自裁,但给一条强建议和一个排序论证。

先说清它是什么:提交路由的 allowedFields.size === 0 || 限支,让一个没有 sections 的公开表单接受匿名访客提交的任意非锚点键 —— dev 实测连 not_even_a_field(对象根本没声明的键)都到达了 createData。这是匿名批量赋值,是 #6601 的写侧孪生,危害高于 #6601。

为什么不自裁

它与 #6601 有一处实质区别,不是程度差别:

• finding: a section-less public form publishes EVERY field of its target object to anonymous callers #6601 只是从响应里拿掉信息 —— 没有任何请求因此失败;
• finding: a section-less public form accepts ANY non-anchor field from an anonymous visitor (the write-side twin of #6601) #6920 会让今天成功的写入开始失败。这是公开端点上的拒收,真实自建集成可能正在依赖它,而「我们仓里没人这么用」推不出「没有部署这么用」。

再加上 #3022 的测试把这条 fall-through 钉为「预期行为」 —— 改它等于重判那个钉子,把一条已发布的成功路径变成拒绝。dev 因此没有顺手修,判断正确。

本席的建议:修,而且理由在 #6601 落地后变强了

⚠️ 这一点请一并考虑,因为它改变了权衡:#6601 合入后,零 sections 的表单不再发布任何 schema(fields: {})。也就是说,喂养这条宽写入面的那条读取面已经没有了 —— 匿名客户端连对象有哪些字段都无从得知。

于是留着写侧的「全接受」不再服务任何合法流程,只剩下:读侧收窄、写侧洞开的不对称。而在这两半之间,不对称比任何一种一致的选择都糟 —— 它正是本车道今晚反复撞到的那类形状(一个看起来收紧了的系统,实际只收紧了能被看见的那一半)。

同一个 size === 0 退化的两半,应当得到同一个答案。

需要你拍的具体是

1. 是否拒收(零声明字段的公开表单不接受任何业务键),以及
2. 拒收还是静默丢弃 —— 丢弃不改变 HTTP 结果、破坏面更小,但会静默吞掉调用方以为写进去的数据,属 AGENTS.md 明令的那类静默;本席倾向拒收 + 明确 error.code。
3. 要不要同时重判 安全:公开表单(publicFormGrant)提交绕过 owner_id 属主守卫 → 匿名可伪造属主 #3022 的那个钉子 —— 它是这条行为的现有依据,不动它就无法落地。

可选降险测量,本席可以先派(不需要先裁):普查是否存在任何已发布的公开表单模板/示例/文档教人使用零 sections 形态。若一个都没有,拒收的破坏面就基本只剩理论上的自建集成。

与同批的关系

• finding: a section-less public form publishes EVERY field of its target object to anonymous callers #6601 —— 读侧,PR fix(rest): 公开表单发布的 schema 就是它声明的字段集,不再是「一个都没声明就发全部」(#6601) #6933 已 ready + arm,不等本卡;
• finding: after ADR-0106, a restricted caller's GET → edit → PUT of an object schema DELETES the fields that were masked out of their read #6603 —— 同为公开面访问变更的裁决,已在决策箱;两张可以一起裁,判据同族(「能写的人是不是就是能看见全部的人」)。
• finding: /meta/_drafts serves DRAFT object schemas unmasked — the one ADR-0106 outlet left uncovered #6599 —— /meta/_drafts,排在 finding: a section-less public form publishes EVERY field of its target object to anonymous callers #6601 释放 rest-server.ts 之后,带停机条件派。

已补 domain:cli 标签(本卡立时无 domain,会从各席的队列扫描里漏掉)。

---

Generated by Claude Code

[os-project-manager]

Maintainer ruling (2026-08-09): symmetric refusal — a section-less public form accepts NO fields. pm:queue.

Adopt the card's suggested disposition: drop the allowedFields.size === 0 || limb in the POST /api/v1/forms/:slug/submit filter so a public form that declares no sections refuses the submit with a 400-class error naming the empty declaration, instead of inserting a row built from whatever keys the caller sent. This makes "the form declares what it collects" one rule on both planes, symmetric with #6601's read side.

Rationale (three-axis): the authoring mid-state (form created, sections wired later) leaves the whole object anonymously mass-assignable today — a real security exposure, not theoretical; one rule across read and write beats two divergent surfaces; and the #3022 pin that asserts the fall-through as intentional is exactly the kind of wrong invariant that trains future authors (human and AI) to preserve a hole — the implementing PR re-judges that pin deliberately, as the card requires. This is a behaviour change on a shipped success path: changeset + release-note line required (a section-less form's submits start failing loudly — which is also what its post-#6601 read side already implies, since it publishes no schema).

Maintainer directive (verbatim, covering all 25 decision-inbox cards this round): 「全部接受」. Recorded by PM session session_01LGRN2cSRfggfX9B2L83bQc. Veto window open — comment to overturn.

---

Generated by Claude Code