Pine/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

fix(schema): harden realm-safe JSON validation

Browse Source
This commit is contained in:
Tianyi Cui
2026-07-21 22:11:41 +08:00
parent acc628f3af
commit 384cc8c157
6 changed files with 46 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/cordis/tool-cordis/src/guard.ts
+3
View File
@@ -55,6 +55,9 @@ function cloneJson(value: unknown, path: string, seen = new Set<object>()): unkn
return output
}
if (!isPlainRecord(value)) throw new Error(`harness.defineTool ${path} must be lossless JSON data`)
if (Reflect.ownKeys(value).some(key => typeof key !== 'string' || !Object.prototype.propertyIsEnumerable.call(value, key))) {
throw new Error(`harness.defineTool ${path} must be lossless JSON data`)
}
const output: Record<string, unknown> = {}
for (const [key, entry] of Object.entries(value)) {
Object.defineProperty(output, key, {
packages/cordis/tool-cordis/tests/mount.spec.ts
+2
View File
@@ -345,6 +345,8 @@ describe('cordis_mount', () => {
['parameters: { value: { type: \'json\', default: Array(2) } }', 'parameters.value.default must be lossless JSON data'],
['parameters: { value: { type: \'json\', default: Object.assign([1], { extra: true }) } }', 'parameters.value.default must be lossless JSON data'],
['parameters: { value: { type: \'json\', default: (() => { const v = Array(1); v.extra = true; return v })() } }', 'parameters.value.default must be lossless JSON data'],
['parameters: { value: { type: \'json\', default: Object.defineProperty({}, \'hidden\', { value: true }) } }', 'parameters.value.default must be lossless JSON data'],
['parameters: { value: { type: \'json\', default: { [Symbol(\'hidden\')]: true } } }', 'parameters.value.default must be lossless JSON data'],
['parameters: { value: { type: \'json\', default: new (class DefaultValue { constructor() { this.ok = true } })() } }', 'parameters.value.default must be lossless JSON data'],
['parameters: { value: { type: \'json\', default: new Date(0) } }', 'parameters.value.default must be lossless JSON data'],
])('rejects a malformed ParameterSchemaSpec (%s) with a teaching error', async (parameters, message) => {