> Filed by the `fuzz-run` finder (agentic fuzz-testing of AR). Labels are **proposals** — please confirm severity/subtype at triage, then flip `fuzz::triage` → `fuzz::approved` or close. `fingerprint: npm:publish-accepts-nonsemver-version-201-then-packument-GET-500` ## Summary Publishing an npm package whose `version` key is **not valid semver** is accepted with `201 Created`, but **every subsequent packument GET then returns `500 internal_server_error`**. The package row is created yet permanently unreadable and uninstallable (`npm install` → E500). This violates AR's own spec, which requires the publish to be rejected with `422 version_invalid` and write no rows. Reproducing versions include `1.0`, `01.0.0`, `1.0.0.0`, `v2.0.0`, `1.0.0-`, `1.2.3-beta.01`. Valid semver (including build metadata like `1.0.0+only.build`) is unaffected (200). ## Oracle & spec - **Oracle:** 5xx on a well-formed request **+** state inconsistency (a `201`-created resource is permanently unreadable). - **Spec (AR's own):** `docs/specs/S11-npm-hosted.md:1708-1710` — *"A publish whose version key in `versions` is not a valid semver … returns `422` `code: version_invalid` and writes no rows"*; Error Cases table `:1874` — *"Version is not a valid semver | 422, code: version_invalid"*. - Not a 4xx-on-garbage case: the malformed input is **accepted** (201); the failing packument GET is a fully well-formed, spec-conformant read. ## Root cause (traced in source) - **Publish accepts it:** the npm publish pipeline validates the package name and dist-tag shape but **never validates the `versions`-map key is semver**. `internal/format/npm/streampub/versions.go:29` captures the key verbatim; it is persisted to `npm_versions.version` with a 201. There is no `ValidateVersion` gate symmetric to the existing name validation. - **Read fails closed:** the packument generator re-validates every stored version (`internal/format/npm/packument.go:349`, `buildVersionEntries`) and is deliberately fail-closed — an unparseable version aborts the whole build with an error, which `serveInlineBuild` turns into a `500`. - **The code assumes this is impossible:** `packument.go:38-41` comments that versions are *"assumed already validated upstream (Step 7 name/semver validation)"* and frames an invalid stored version as a *"data-integrity violation … never reached under normal operation."* That guarantee is false — publish has no semver gate. - **Fix direction:** add a publish-time `ValidateVersion(res.VersionKey)` gate returning `422 version_invalid` and writing no rows, per S11. - **Novelty:** novel — no in-tree acknowledgement of the gap (the only relevant comments assert the opposite). ## Reproduction Fresh namespace from clean state (parameterized — no hardcoded slug): ```sh # from the fuzz-lab workspace on the e2e-fuzzy-tester VM eval "$(tooling/run-setup.sh repro-badsemver npm)" export AR_TOKEN=$(sudo cat /srv/ar/bootstrap-token.txt) bash journal/152284389-3/invalid-semver-500.repro.sh # publish → HTTP 201 (expected 422); packument GET → HTTP 500 (expected 200/4xx) ``` The repro script (self-contained; builds a spec-conformant publish envelope with a real tarball): <details><summary>invalid-semver-500.repro.sh</summary> ```sh #!/usr/bin/env bash # Repro: AR accepts a publish whose version is not valid semver (e.g. "1.0.0.0"), # returns 201, then 500s on every subsequent packument GET for that package. # Oracle: 5xx on well-formed request + state inconsistency. # # Preconditions: AR_NPM_REGISTRY, AR_TOKEN exported (from run-setup.sh <key> npm). # Self-contained: builds a spec-conformant npm publish envelope from scratch. set -uo pipefail : "${AR_NPM_REGISTRY:?}"; : "${AR_TOKEN:?}" PKG="badver-repro" BADVER="1.0.0.0" # not valid semver (4 numeric components) WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT # --- build a spec-conformant publish envelope with a real tiny tarball --- ENV_JSON="$WORK/env.json" AR_NPM_REGISTRY="$AR_NPM_REGISTRY" PKG="$PKG" BADVER="$BADVER" node -e ' const crypto=require("crypto"),cp=require("child_process"),fs=require("fs"),os=require("os"),path=require("path"); const name=process.env.PKG, version=process.env.BADVER, reg=process.env.AR_NPM_REGISTRY; const tmp=fs.mkdtempSync(path.join(os.tmpdir(),"e-")); const pd=path.join(tmp,"package"); fs.mkdirSync(pd); fs.writeFileSync(path.join(pd,"package.json"),JSON.stringify({name,version,main:"index.js"})); fs.writeFileSync(path.join(pd,"index.js"),"module.exports=1;\n"); const tgz=`${name}-${version}.tgz`, tp=path.join(tmp,tgz); cp.execSync(`tar -czf ${JSON.stringify(tp)} -C ${JSON.stringify(tmp)} package`); const buf=fs.readFileSync(tp); const env={_id:name,name,"dist-tags":{latest:version}, versions:{[version]:{name,version,_id:`${name}@${version}`, dist:{shasum:crypto.createHash("sha1").update(buf).digest("hex"), integrity:"sha512-"+crypto.createHash("sha512").update(buf).digest("base64"), tarball:`${reg}${name}/-/${tgz}`}}}, _attachments:{[tgz]:{content_type:"application/octet-stream",data:buf.toString("base64"),length:buf.length}}}; process.stdout.write(JSON.stringify(env)); ' > "$ENV_JSON" echo "== PUT publish (version=$BADVER, invalid semver) ==" pub=$(curl -s -o /dev/null -w '%{http_code}' -X PUT \ -H "Authorization: Bearer $AR_TOKEN" -H 'Content-Type: application/json' \ --data-binary @"$ENV_JSON" "${AR_NPM_REGISTRY}${PKG}") echo "publish HTTP $pub (expected: 422 reject; AR returns 201)" echo "== GET packument ==" get=$(curl -s -o "$WORK/out" -w '%{http_code}' -H "Authorization: Bearer $AR_TOKEN" "${AR_NPM_REGISTRY}${PKG}") echo "packument GET HTTP $get (expected: 200 or 4xx; BUG: 500)" head -c 200 "$WORK/out"; echo if [ "$get" = "500" ]; then echo "REPRODUCED: 5xx on well-formed packument GET"; exit 0; fi echo "did not reproduce"; exit 1 ``` </details> Journal (op-by-op audit trail with predicted-vs-observed) lives at `journal/152284389-3.jsonl` seq 9–11 on the finder VM. ## Environment - AR **version 1.181.0**, commit `f9b0b10d6a55f197a712f6805f55d5494264f2fa` (stable across the run; no auto-update window). - Client: pnpm 11.15.1 / npm 12.0.1 (finding is client-independent — the failing read is a bare `curl` GET). - Finder run `SEED=152284389`, shard `152284389-3`. ## Verification Independently reproduced by a black-box skeptic in a fresh namespace (deterministic, 5/5), harness ruled out (bare curl GET returns AR's own `internal_server_error` + `X-Request-Id`), auto-update guard passed. White-box root-cause confirmed the mechanism and novelty above.