* fix: validate parsed JSON at untrusted boundaries with Valibot Clipboard HTML, library revisions from shared storage, MCP and automation WebSocket messages, the MCP discovery file, sidecar output and AI/MCP tool arguments were JSON.parse'd and cast to their expected types, so a malformed payload reached the document or crashed paste. They now go through v.pipe(v.string(), v.parseJson(), Schema), which reports bad JSON and a wrong shape as the same validation failure. The path_set tool rejects an invalid VectorNetwork and shares its parser with create_vector. The CLI library catalog validates its files and runs revisions through the same size, identity and content-hash checks as the app; reading image bytes as index-keyed records also stops them coming back empty. Hand-rolled typeof readers for plugin data, document metadata, caches and preferences become schemas with their behaviour preserved, and readCacheJSON takes a schema for its payload. open-pencil/no-unvalidated-json-parse rejects type assertions on JSON.parse results other than `as unknown` in src and packages/*/src. * refactor: validate parsed JSON in tests and tooling Extend open-pencil/no-unvalidated-json-parse beyond source: tests, helpers and repo tooling now parse JSON through Valibot schemas instead of asserting a type. The shared fixture reader returns a validated object; its old array annotation never matched the fixtures. * fix: validate clipboard geometry bytes, library images and model catalogs Clipboard geometry blobs and library image bytes must be bytes at contiguous indexes, so out-of-range or gapped values are rejected instead of silently becoming different geometry or images; serialized library nodes must carry source metadata. The models.dev and OpenRouter responses are validated like their cached copies, and activate-tab rejects a CDP frame it cannot read instead of hanging. * refactor: extend the JSON validation lint to .json() results no-unvalidated-json-parse now also rejects type assertions on Response, Bun.file and shell .json() results, the same unchecked parse in another form. MCP server tests read /health through a validated readHealth helper and discovery files through parseDiscoveryInfo; the remaining tooling reads its JSON through schemas. * test: validate the RPC request body in the CLI app export test * test: validate CLI JSON output in the tool and app command tests * test: compare the malformed models.dev fallback with the curated list
122 lines
3.6 KiB
TypeScript
122 lines
3.6 KiB
TypeScript
import { existsSync, readFileSync } from 'node:fs'
|
|
import { resolve } from 'node:path'
|
|
|
|
import * as v from 'valibot'
|
|
|
|
import {
|
|
parseFigFile,
|
|
type ParseFigFileOptions,
|
|
type SceneGraph,
|
|
type SceneNode
|
|
} from '@open-pencil/core'
|
|
|
|
import { collectAllNodes } from './traversal'
|
|
|
|
export const FIXTURES = resolve(import.meta.dir, '../../fixtures')
|
|
|
|
export const VALID_NODE_TYPES = new Set<string>([
|
|
'CANVAS',
|
|
'FRAME',
|
|
'RECTANGLE',
|
|
'ROUNDED_RECTANGLE',
|
|
'ELLIPSE',
|
|
'TEXT',
|
|
'LINE',
|
|
'STAR',
|
|
'POLYGON',
|
|
'VECTOR',
|
|
'GROUP',
|
|
'SECTION',
|
|
'COMPONENT',
|
|
'COMPONENT_SET',
|
|
'INSTANCE',
|
|
'BOOLEAN_OPERATION',
|
|
'CONNECTOR',
|
|
'SHAPE_WITH_TEXT'
|
|
])
|
|
|
|
const FixtureObjectJSON = v.pipe(v.string(), v.parseJson(), v.record(v.string(), v.unknown()))
|
|
|
|
/** Read a shared JSON fixture object. */
|
|
export function readFixtureObject(name: string): Record<string, unknown> {
|
|
return v.parse(FixtureObjectJSON, readFileSync(resolve(FIXTURES, name), 'utf8'))
|
|
}
|
|
|
|
export function readFixtureBytes(name: string): Uint8Array {
|
|
return readFileSync(resolve(FIXTURES, name))
|
|
}
|
|
|
|
export function uint8ArrayToArrayBuffer(bytes: Uint8Array): ArrayBuffer {
|
|
const buffer = bytes.buffer
|
|
if (buffer instanceof ArrayBuffer) {
|
|
return buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength)
|
|
}
|
|
|
|
const copy = new Uint8Array(bytes.byteLength)
|
|
copy.set(bytes)
|
|
return copy.buffer
|
|
}
|
|
|
|
export function readFixtureArrayBuffer(name: string): ArrayBuffer {
|
|
return uint8ArrayToArrayBuffer(readFixtureBytes(name))
|
|
}
|
|
|
|
export async function parseFixture(
|
|
name: string,
|
|
options?: ParseFigFileOptions
|
|
): Promise<SceneGraph> {
|
|
return parseFigFile(readFixtureArrayBuffer(name), options)
|
|
}
|
|
|
|
export async function parseGoldPreviewFixture(): Promise<{
|
|
graph: SceneGraph
|
|
allNodes: SceneNode[]
|
|
}> {
|
|
const graph = await parseFixture('gold-preview.fig')
|
|
return { graph, allNodes: collectAllNodes(graph) }
|
|
}
|
|
|
|
let sharedGoldPreview: ReturnType<typeof parseGoldPreviewFixture> | null = null
|
|
|
|
/**
|
|
* The fully populated `gold-preview.fig` graph, parsed once per process.
|
|
*
|
|
* Populating its ~38k instance children costs about 3 s and 700 MB, and a
|
|
* shard runs every file in one Bun process, so read-only suites share the
|
|
* result instead of paying that per file. Treat the graph as immutable: a
|
|
* test that creates, updates, deletes or lays out nodes must call
|
|
* `parseGoldPreviewFixture()` for its own copy.
|
|
*/
|
|
export function sharedGoldPreviewFixture(): ReturnType<typeof parseGoldPreviewFixture> {
|
|
sharedGoldPreview ??= parseGoldPreviewFixture()
|
|
return sharedGoldPreview
|
|
}
|
|
|
|
const LFS_POINTER_PREFIX = 'version https://git-lfs'
|
|
|
|
/**
|
|
* Read a `.fig` fixture by absolute path, or `null` when it is absent OR an
|
|
* un-fetched Git LFS pointer. `tests/fixtures/*.fig` are LFS-tracked, so on a
|
|
* shallow/LFS-less checkout `existsSync` passes but the bytes are a tiny ASCII
|
|
* pointer stub — parsing it would throw. Optional-local tests skip on `null`.
|
|
* (Contrast `readFixtureBytes`/`parseFixture`, which take a name and assume the
|
|
* fixture is present.)
|
|
*/
|
|
export function readFigFixture(path: string): ArrayBuffer | null {
|
|
if (!existsSync(path)) return null
|
|
const bytes = readFileSync(path)
|
|
if (
|
|
bytes.length < 1024 &&
|
|
bytes.toString('utf8', 0, LFS_POINTER_PREFIX.length) === LFS_POINTER_PREFIX
|
|
) {
|
|
return null
|
|
}
|
|
return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength)
|
|
}
|
|
|
|
/** Parse a `.fig` fixture by path into a SceneGraph, or `null` when unavailable (see readFigFixture). */
|
|
export async function loadFigFixture(path: string): Promise<SceneGraph | null> {
|
|
const ab = readFigFixture(path)
|
|
return ab ? parseFigFile(ab) : null
|
|
}
|