e2a3aa3f80
* fix: validate parsed JSON at untrusted boundaries with Valibot Clipboard HTML, library revisions from shared storage, MCP and automation WebSocket messages, the MCP discovery file, sidecar output and AI/MCP tool arguments were JSON.parse'd and cast to their expected types, so a malformed payload reached the document or crashed paste. They now go through v.pipe(v.string(), v.parseJson(), Schema), which reports bad JSON and a wrong shape as the same validation failure. The path_set tool rejects an invalid VectorNetwork and shares its parser with create_vector. The CLI library catalog validates its files and runs revisions through the same size, identity and content-hash checks as the app; reading image bytes as index-keyed records also stops them coming back empty. Hand-rolled typeof readers for plugin data, document metadata, caches and preferences become schemas with their behaviour preserved, and readCacheJSON takes a schema for its payload. open-pencil/no-unvalidated-json-parse rejects type assertions on JSON.parse results other than `as unknown` in src and packages/*/src. * refactor: validate parsed JSON in tests and tooling Extend open-pencil/no-unvalidated-json-parse beyond source: tests, helpers and repo tooling now parse JSON through Valibot schemas instead of asserting a type. The shared fixture reader returns a validated object; its old array annotation never matched the fixtures. * fix: validate clipboard geometry bytes, library images and model catalogs Clipboard geometry blobs and library image bytes must be bytes at contiguous indexes, so out-of-range or gapped values are rejected instead of silently becoming different geometry or images; serialized library nodes must carry source metadata. The models.dev and OpenRouter responses are validated like their cached copies, and activate-tab rejects a CDP frame it cannot read instead of hanging. * refactor: extend the JSON validation lint to .json() results no-unvalidated-json-parse now also rejects type assertions on Response, Bun.file and shell .json() results, the same unchecked parse in another form. MCP server tests read /health through a validated readHealth helper and discovery files through parseDiscoveryInfo; the remaining tooling reads its JSON through schemas. * test: validate the RPC request body in the CLI app export test * test: validate CLI JSON output in the tool and app command tests * test: compare the malformed models.dev fallback with the curated list
99 lines
3.4 KiB
TypeScript
99 lines
3.4 KiB
TypeScript
import { describe, expect, test } from 'bun:test'
|
|
|
|
import {
|
|
BOUND_VARIABLES_PLUGIN_KEY,
|
|
EXPORT_SETTINGS_PLUGIN_KEY,
|
|
extractBoundVariables,
|
|
extractExportSettings,
|
|
extractLibrarySource,
|
|
extractTextPathBox,
|
|
LIBRARY_SOURCE_PLUGIN_KEY,
|
|
OPEN_PENCIL_PLUGIN_ID,
|
|
TEXT_PATH_BOX_PLUGIN_KEY
|
|
} from '#fig/node-change/plugin-data'
|
|
|
|
import type { NodeChange } from '@open-pencil/kiwi/fig/codec'
|
|
import { clampExportScale } from '@open-pencil/scene-graph'
|
|
|
|
function withPluginValue(key: string, value: string, extra: NodeChange = {}): NodeChange {
|
|
return { ...extra, pluginData: [{ pluginID: OPEN_PENCIL_PLUGIN_ID, key, value }] }
|
|
}
|
|
|
|
describe('OpenPencil plugin data readers', () => {
|
|
test('textPathBox requires finite numbers and a positive size', () => {
|
|
const box = { x: 1, y: 2, width: 30, height: 40 }
|
|
expect(
|
|
extractTextPathBox(withPluginValue(TEXT_PATH_BOX_PLUGIN_KEY, JSON.stringify(box)))
|
|
).toEqual(box)
|
|
for (const value of [
|
|
'{not json',
|
|
'null',
|
|
JSON.stringify({ ...box, width: 0 }),
|
|
JSON.stringify({ ...box, x: '1' })
|
|
]) {
|
|
expect(extractTextPathBox(withPluginValue(TEXT_PATH_BOX_PLUGIN_KEY, value))).toBeNull()
|
|
}
|
|
})
|
|
|
|
test('bound variables keep string entries and drop the rest', () => {
|
|
const value = JSON.stringify({ opacity: 'VariableID:1:2', width: 3 })
|
|
expect(extractBoundVariables(withPluginValue(BOUND_VARIABLES_PLUGIN_KEY, value))).toEqual({
|
|
opacity: 'VariableID:1:2'
|
|
})
|
|
for (const malformed of ['{not json', '["VariableID:1:2"]', '"VariableID:1:2"']) {
|
|
expect(extractBoundVariables(withPluginValue(BOUND_VARIABLES_PLUGIN_KEY, malformed))).toEqual(
|
|
{}
|
|
)
|
|
}
|
|
})
|
|
|
|
test('export settings clamp scales and fall back to native settings when any entry is invalid', () => {
|
|
const native: NodeChange = {
|
|
exportSettings: [{ imageType: 'SVG', constraint: { type: 'CONTENT_SCALE', value: 1 } }]
|
|
}
|
|
expect(
|
|
extractExportSettings(
|
|
withPluginValue(
|
|
EXPORT_SETTINGS_PLUGIN_KEY,
|
|
JSON.stringify([{ scale: 1000, format: 'png' }])
|
|
)
|
|
)
|
|
).toEqual([{ scale: clampExportScale(1000), format: 'png' }])
|
|
for (const value of [
|
|
'{not json',
|
|
JSON.stringify({ scale: 1, format: 'png' }),
|
|
JSON.stringify([
|
|
{ scale: 2, format: 'png' },
|
|
{ scale: 1, format: 'gif' }
|
|
])
|
|
]) {
|
|
expect(
|
|
extractExportSettings(withPluginValue(EXPORT_SETTINGS_PLUGIN_KEY, value, native))
|
|
).toEqual([{ scale: 1, format: 'svg' }])
|
|
}
|
|
})
|
|
|
|
test('library source defaults its optional fields and rejects a malformed identity', () => {
|
|
const identity = { libraryId: 'lib', assetKey: 'button', revisionId: 'r1' }
|
|
expect(
|
|
extractLibrarySource(
|
|
withPluginValue(LIBRARY_SOURCE_PLUGIN_KEY, JSON.stringify({ identity, readOnly: 'yes' }))
|
|
)
|
|
).toEqual({ identity, sourceNodeId: null, readOnly: false })
|
|
expect(
|
|
extractLibrarySource(
|
|
withPluginValue(
|
|
LIBRARY_SOURCE_PLUGIN_KEY,
|
|
JSON.stringify({ identity, sourceNodeId: '1:2', readOnly: true })
|
|
)
|
|
)
|
|
).toEqual({ identity, sourceNodeId: '1:2', readOnly: true })
|
|
for (const value of [
|
|
'{not json',
|
|
JSON.stringify({ identity: { ...identity, revisionId: 1 } })
|
|
]) {
|
|
expect(extractLibrarySource(withPluginValue(LIBRARY_SOURCE_PLUGIN_KEY, value))).toBeNull()
|
|
}
|
|
})
|
|
})
|