json

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

.changeset/rare-cougars-cross.md

@@ -0,0 +1,16 @@
+---
+'@backstage/backend-common': patch
+'@backstage/cli': patch
+'@backstage/plugin-airbrake-backend': patch
+'@backstage/plugin-badges-backend': patch
+'@backstage/plugin-catalog-backend': patch
+'@backstage/plugin-graphql-backend': patch
+'@backstage/plugin-periskop-backend': patch
+'@backstage/plugin-permission-backend': patch
+'@backstage/plugin-rollbar-backend': patch
+'@backstage/plugin-search-backend': patch
+'@backstage/plugin-tech-insights-backend': patch
+'@backstage/plugin-user-settings-backend': patch
+---
+
+Use `response.json` rather than `response.send` where appropriate, as outlined in `SECURITY.md`

docs/plugins/call-existing-api.md

@@ -132,7 +132,7 @@ router.use('/summary', async (req, res) => {
   ]).then(async ([frobs, flerps, thunk]) => {
     return computeAggregate(await frobs.json(), await flerps.json(), thunk);
   });
-  res.status(200).send(agg);
+  res.status(200).json(agg);
 });
 ```
 

packages/backend-common/src/middleware/notFoundHandler.test.ts

@@ -21,7 +21,7 @@ import { notFoundHandler } from './notFoundHandler';
 describe('notFoundHandler', () => {
   it('handles only missing routes', async () => {
     const app = express();
-    app.use('/exists', (_, res) => res.status(200).send());
+    app.use('/exists', (_, res) => res.status(200).end());
     app.use(notFoundHandler());
 
     const existsResponse = await request(app).get('/exists');

packages/backend-common/src/middleware/notFoundHandler.ts

@@ -28,6 +28,6 @@ import { NextFunction, Request, RequestHandler, Response } from 'express';
 export function notFoundHandler(): RequestHandler {
   /* eslint-disable @typescript-eslint/no-unused-vars */
   return (_request: Request, response: Response, _next: NextFunction) => {
-    response.status(404).send();
+    response.status(404).end();
   };
 }

packages/backend-common/src/middleware/requestLoggingHandler.test.ts

@@ -26,8 +26,8 @@ describe('requestLoggingHandler', () => {
 
     const app = express();
     app.use(requestLoggingHandler(logger));
-    app.use('/exists1', (_, res) => res.status(200).send());
-    app.use('/exists2', (_, res) => res.status(201).send());
+    app.use('/exists1', (_, res) => res.status(200).end());
+    app.use('/exists2', (_, res) => res.status(201).end());
 
     const r = request(app);
     await r.get('/exists1');

packages/backend-common/src/middleware/statusCheckHandler.ts

@@ -55,7 +55,7 @@ export async function statusCheckHandler(
   return async (_request: Request, response: Response, next: NextFunction) => {
     try {
       const status = await statusCheck();
-      response.status(200).header('').send(status);
+      response.status(200).json(status);
     } catch (err) {
       next(err);
     }

packages/cli/templates/default-backend-plugin/src/service/router.ts

@@ -33,7 +33,7 @@ export async function createRouter(
 
   router.get('/health', (_, response) => {
     logger.info('PONG!');
-    response.send({ status: 'ok' });
+    response.json({ status: 'ok' });
   });
   router.use(errorHandler());
   return router;

plugins/airbrake-backend/src/service/router.ts

@@ -79,7 +79,7 @@ export async function createRouter(
 
   router.get('/health', (_, response) => {
     logger.info('PONG!');
-    response.send({ status: 'ok' });
+    response.json({ status: 'ok' });
   });
 
   router.use(

plugins/badges-backend/src/service/router.test.ts

@@ -114,7 +114,7 @@ describe('createRouter', () => {
       );
 
       expect(response.status).toEqual(200);
-      expect(response.text).toEqual(JSON.stringify([badge], null, 2));
+      expect(response.body).toEqual([badge]);
 
       expect(catalog.getEntityByRef).toHaveBeenCalledTimes(1);
       expect(catalog.getEntityByRef).toHaveBeenCalledWith(

plugins/badges-backend/src/service/router.ts

@@ -78,8 +78,7 @@ export async function createRouter(
       specs.push(badge);
     }
 
-    res.setHeader('Content-Type', 'application/json');
-    res.status(200).send(JSON.stringify(specs, null, 2));
+    res.status(200).json(specs);
   });
 
   router.get(

plugins/catalog-backend/src/service/createRouter.ts

@@ -98,7 +98,7 @@ export async function createRouter(
       );
 
       await refreshService.refresh(refreshOptions);
-      res.status(200).send();
+      res.status(200).end();
     });
   }
 

plugins/example-todo-list-backend/src/service/router.ts

@@ -51,7 +51,7 @@ export async function createRouter(
 
   router.get('/health', (_, response) => {
     logger.info('PONG!');
-    response.send({ status: 'ok' });
+    response.json({ status: 'ok' });
   });
 
   router.get('/todos', async (_req, res) => {

plugins/graphql-backend/src/service/router.ts

@@ -58,7 +58,7 @@ export async function createRouter(
   const router = Router();
 
   router.get('/health', (_, response) => {
-    response.send({ status: 'ok' });
+    response.json({ status: 'ok' });
   });
 
   const apolloMiddleware = server.getMiddleware({ path: '/' });

plugins/periskop-backend/src/service/router.ts

@@ -43,7 +43,7 @@ export async function createRouter(
 
   router.get('/health', (_, response) => {
     logger.info('PONG!');
-    response.send({ status: 'ok' });
+    response.json({ status: 'ok' });
   });
 
   router.get('/:locationName/:serviceName', async (request, response) => {

plugins/permission-backend/src/service/router.ts

@@ -179,7 +179,7 @@ export async function createRouter(
   router.use(express.json());
 
   router.get('/health', (_, response) => {
-    response.send({ status: 'ok' });
+    response.json({ status: 'ok' });
   });
 
   router.post(

plugins/rollbar-backend/src/service/router.ts

@@ -48,40 +48,40 @@ export async function createRouter(
 
     router.get('/projects', async (_req, res) => {
       const projects = await rollbarApi.getAllProjects();
-      res.status(200).header('').send(projects);
+      res.status(200).json(projects);
     });
 
     router.get('/projects/:id', async (req, res) => {
       const { id } = req.params;
       const projects = await rollbarApi.getProject(id);
-      res.status(200).send(projects);
+      res.status(200).json(projects);
     });
 
     router.get('/projects/:id/items', async (req, res) => {
       const { id } = req.params;
       const projects = await rollbarApi.getProjectItems(id);
-      res.status(200).send(projects);
+      res.status(200).json(projects);
     });
 
     router.get('/projects/:id/top_active_items', async (req, res) => {
       const { id } = req.params;
       const query = req.query;
       const items = await rollbarApi.getTopActiveItems(id, query as any);
-      res.status(200).send(items);
+      res.status(200).json(items);
     });
 
     router.get('/projects/:id/occurance_counts', async (req, res) => {
       const { id } = req.params;
       const query = req.query;
       const items = await rollbarApi.getOccuranceCounts(id, query as any);
-      res.status(200).send(items);
+      res.status(200).json(items);
     });
 
     router.get('/projects/:id/activated_item_counts', async (req, res) => {
       const { id } = req.params;
       const query = req.query;
       const items = await rollbarApi.getActivatedCounts(id, query as any);
-      res.status(200).send(items);
+      res.status(200).json(items);
     });
   }
 

plugins/search-backend/src/service/router.ts

@@ -173,7 +173,7 @@ export async function createRouter(
       try {
         const resultSet = await engine?.query(query, { token });
 
-        res.send(filterResultSet(toSearchResults(resultSet)));
+        res.json(filterResultSet(toSearchResults(resultSet)));
       } catch (error) {
         if (error.name === 'MissingIndexError') {
           // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form

plugins/tech-insights-backend/src/service/router.ts

@@ -87,7 +87,7 @@ export async function createRouter<
   if (factChecker) {
     logger.info('Fact checker configured. Enabling fact checking endpoints.');
     router.get('/checks', async (_req, res) => {
-      return res.send(await factChecker.getChecks());
+      return res.json(await factChecker.getChecks());
     });
 
     router.post('/checks/run/:namespace/:kind/:name', async (req, res) => {
@@ -95,7 +95,7 @@ export async function createRouter<
       const { checks }: { checks: string[] } = req.body;
       const entityTriplet = stringifyEntityRef({ namespace, kind, name });
       const checkResult = await factChecker.runChecks(entityTriplet, checks);
-      return res.send(checkResult);
+      return res.json(checkResult);
     });
 
     router.post('/checks/run', async (req, res) => {
@@ -113,7 +113,7 @@ export async function createRouter<
         };
       });
       const results = await Promise.all(tasks);
-      return res.send(results);
+      return res.json(results);
     });
   } else {
     logger.info(
@@ -123,7 +123,7 @@ export async function createRouter<
 
   router.get('/fact-schemas', async (req, res) => {
     const ids = req.query.ids as string[];
-    return res.send(await techInsightsStore.getLatestSchemas(ids));
+    return res.json(await techInsightsStore.getLatestSchemas(ids));
   });
 
   /**
@@ -136,10 +136,10 @@ export async function createRouter<
     if (!req.query.ids) {
       return res
         .status(422)
-        .send({ error: 'Failed to parse ids from request' });
+        .json({ error: 'Failed to parse ids from request' });
     }
     const ids = [req.query.ids].flat() as string[];
-    return res.send(
+    return res.json(
       await techInsightsStore.getLatestFactsByIds(
         ids,
         stringifyEntityRef({ namespace, kind, name }),
@@ -157,20 +157,20 @@ export async function createRouter<
     if (!req.query.ids) {
       return res
         .status(422)
-        .send({ error: 'Failed to parse ids from request' });
+        .json({ error: 'Failed to parse ids from request' });
     }
     const ids = [req.query.ids].flat() as string[];
     const startDatetime = DateTime.fromISO(req.query.startDatetime as string);
     const endDatetime = DateTime.fromISO(req.query.endDatetime as string);
     if (!startDatetime.isValid || !endDatetime.isValid) {
-      return res.status(422).send({
+      return res.status(422).json({
         message: 'Failed to parse datetime from request',
         field: !startDatetime.isValid ? 'startDateTime' : 'endDateTime',
         value: !startDatetime.isValid ? startDatetime : endDatetime,
       });
     }
     const entityTriplet = stringifyEntityRef({ namespace, kind, name });
-    return res.send(
+    return res.json(
       await techInsightsStore.getFactsBetweenTimestampsByIds(
         ids,
         entityTriplet,