fix(hardening): guard three malformed-input crashes (URL, timestamp, pricing entry) - #908
Open
ozymandiashh wants to merge 2 commits into
Open
fix(hardening): guard three malformed-input crashes (URL, timestamp, pricing entry)#908ozymandiashh wants to merge 2 commits into
ozymandiashh wants to merge 2 commits into
Conversation
…erver handle() is dispatched via `void`, so a throw before its try/catch is an unhandled rejection on a LAN-facing server. A request target the HTTP parser accepts but the WHATWG URL parser rejects (unterminated IPv6 host like //[::1) threw at new URL() and hung/killed the process. Parse inside a guard and answer 400. Mutation-checked: the test times out with an unhandled error before the fix, passes after.
- vscode-cline-parser: entry.ts was truthy-checked but not validity-checked, so a garbage timestamp made new Date(ts).toISOString() throw RangeError and abort the whole session parse. Validate the date, fall back to empty. - models: parseLiteLLMEntry read fields off its argument with no null/type guard, so a null value in the remote LiteLLM pricing JSON threw and aborted the entire live pricing load. Return null for a null/non-object entry. Both mutation-checked: the tests raise RangeError / TypeError before the fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three malformed-input hardening fixes surfaced by a systematic multi-agent audit of the codebase (find -> skeptical verify -> adversarial 2-lens -> manual confirmation with a mutation check on each). Grouped here because they share one failure model: untrusted input reaching an unguarded operation that aborts a parse or crashes the process.
1.
share-server.ts- malformed request URL crashes the LAN server.handle()is dispatched viavoid, so a throw before its try/catch is an unhandled rejection. A request target the HTTP parser accepts but the WHATWG URL parser rejects (unterminated IPv6 host//[::1) threw atnew URL()and hung/killed the process. Now parsed inside a guard, answered 400. Mutation-checked: the raw-socket test times out with an unhandled error before the fix.2.
vscode-cline-parser.ts- invalid timestamp aborts a whole session parse.entry.tswas truthy-checked but not validity-checked, so a garbagetsmadenew Date(ts).toISOString()throw RangeError and drop the rest of the session (serves Cline / Roo Code / KiloCode / IBM Bob). Now validated. Mutation-checked: RangeError "Invalid time value" before the fix.3.
models.ts- a null entry in the remote pricing JSON aborts the whole pricing load.parseLiteLLMEntryread fields off its argument with no null/type guard; a null value in the LiteLLM map (fetched from GitHub) threw and failed live pricing entirely. Now returns null for a null/non-object entry. Mutation-checked: TypeError before the fix.Each fix ships with a load-bearing test.
tsc --noEmitclean; 164 tests green across the touched suites. The audit surfaced more candidates across the tree; a triage of the real survivors follows separately so this PR stays focused on the crash class.