Skip to content

Fix out-of-range @ref result references in program interpreter - #393

Merged
Tal Zaccai (TalZaccai) merged 2 commits into
mainfrom
talzaccai-fix-negative-ref-index
Jul 27, 2026
Merged

Fix out-of-range @ref result references in program interpreter#393
Tal Zaccai (TalZaccai) merged 2 commits into
mainfrom
talzaccai-fix-negative-ref-index

Conversation

@TalZaccai

Copy link
Copy Markdown
Contributor

Problem

Result references ({ "@ref": n }) were validated only with typeof index === "number" && index < length. A negative index like -1 passed the check, and results[-1] silently resolved to undefined — substituting undefined where a validated value from a preceding step was expected. createModuleTextFromProgram had the same gap. evaluateJsonProgram is a public export usable without validation, so this is reachable in practice.

Fix

  • Add Number.isInteger(index) && index >= 0 && index < … bounds checks in both evaluateJsonProgram and createModuleTextFromProgram.
  • In the interpreter, throw Invalid result reference on a bad index instead of falling through to an implicit undefined — otherwise it would still silently yield undefined.

Tests

  • Added typescript/test/program.test.ts covering valid, negative, non-integer, and out-of-upper-bound references for both functions, and wired it into the test script.
  • Full suite passes (87/87).

Result references were validated only with 'index < length', accepting negative and non-integer indices. A negative @ref such as -1 passed the check and resolved to undefined, silently substituting undefined where a validated value was expected.

Add Number.isInteger(index) && index >= 0 bounds checks to both evaluateJsonProgram and createModuleTextFromProgram, and throw on an invalid reference in the interpreter instead of falling through to undefined.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens validation and runtime handling of result references ({ "@ref": n }) in the TypeChat program interpreter and module generator so invalid indices (negative/non-integer/out-of-range) no longer silently resolve to undefined.

Changes:

  • Strengthen @ref bounds checks in evaluateJsonProgram and createModuleTextFromProgram to require integer, non-negative indices within bounds.
  • Make the interpreter throw an explicit Invalid result reference error on invalid indices.
  • Add a new TypeScript test file for @ref behavior and wire it into the typescript package test script.
Show a summary per file
File Description
typescript/src/ts/program.ts Adds stricter @ref validation and throws on invalid references during interpretation.
typescript/test/program.test.ts Introduces tests covering valid and invalid result references for both APIs.
typescript/package.json Updates the test script to execute the new compiled test.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 3/3 changed files
  • Comments generated: 3
  • Review effort level: Low

Comment thread typescript/src/ts/program.ts
Comment thread typescript/test/program.test.ts Outdated
Comment thread typescript/test/program.test.ts
…coverage

- Require Object.keys(obj).length === 1 in the interpreter's @ref path so it matches createModuleTextFromProgram and does not treat multi-key objects as references.
- Use String(index) instead of JSON.stringify(index) to avoid throwing on non-JSON values (e.g. bigint) when formatting the error.
- Rename the misleading 'forward reference' test and add an out-of-upper-bound test for createModuleTextFromProgram.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@TalZaccai
Tal Zaccai (TalZaccai) merged commit 75ac404 into main Jul 27, 2026
12 checks passed
Tal Zaccai (TalZaccai) added a commit that referenced this pull request Jul 27, 2026
* Reject unsafe @func names in program validator and interpreter

Add a shared isValidFunctionName predicate used by both
createModuleTextFromProgram and evaluateJsonProgram so a program can
never be validated by one path but dispatched by the other.

- createModuleTextFromProgram now rejects @func values that aren't
  strict identifiers, closing a source-injection hole where comment
  tokens (/* ... */) in @func could comment out later steps so the
  type-checker-based validator never saw them.
- evaluateJsonProgram now throws for @func values that aren't strict
  identifiers or that resolve to an Object.prototype member
  (constructor, __proto__, toString, valueOf, hasOwnProperty, etc.),
  instead of forwarding them to the host onCall dispatcher.

@ref bounds checking is unrelated and already handled by #393.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Address review: fix JSDoc, mirror shape checks in interpreter, reindent tests

- Reword isValidFunctionName JSDoc to describe the actual ASCII
  identifier constraint instead of implying full JS identifier support.
- evaluateJsonProgram's @func branch now mirrors the generator's shape
  checks (args must be an array when present, no unexpected extra
  keys) and throws instead of silently returning undefined when they
  don't hold.
- Re-indent the @func name validation test block to 4 spaces.
- Add tests covering non-array @Args and extra keys for both
  createModuleTextFromProgram and evaluateJsonProgram.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants