mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-31 04:07:52 +00:00
Garry TanandClaude Opus 4.8
51de806d99
Every executeRaw/.unsafe site that bound JSON.stringify(x) to a bare positional jsonb cast double-encodes on real Postgres (same class as #2339). Sweep them all to the text::jsonb form across query-cache, sources-ops, llm-base, calibration-profile, impact-capture, subagent, receipt-write, traversal-cache, symbol-resolver, and the agent/sources commands. Adds scripts/check-jsonb-params.mjs (AST-lite scanner for the positional form the legacy template grep misses, incl. generic-typed calls), wired into check-jsonb-pattern.sh, with a self-test. PGLite's native db.query is not scanned — it parses text to jsonb natively, so the bug can't occur there. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
84 lines
3.1 KiB
TypeScript
84 lines
3.1 KiB
TypeScript
/**
|
|
* Self-test for scripts/check-jsonb-params.mjs — the positional jsonb
|
|
* double-encode guard (#2339 / #2324 class). Verifies it catches the bug shape
|
|
* (including generic-typed calls and the `jsonStr` variable case is acknowledged
|
|
* as out of scope) and does NOT false-positive on the sanctioned forms.
|
|
*
|
|
* Fixtures are written to a temp dir and the scanner is pointed at it via argv,
|
|
* so this never touches the real src/ tree.
|
|
*/
|
|
import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
|
|
import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
|
|
import { join } from 'node:path';
|
|
import { tmpdir } from 'node:os';
|
|
|
|
const SCRIPT = join(import.meta.dir, '..', 'scripts', 'check-jsonb-params.mjs');
|
|
|
|
let root: string;
|
|
let badDir: string;
|
|
let goodDir: string;
|
|
|
|
function runGuard(dir: string): { code: number; err: string } {
|
|
const res = Bun.spawnSync([process.execPath, SCRIPT, dir]);
|
|
return { code: res.exitCode, err: res.stderr.toString() + res.stdout.toString() };
|
|
}
|
|
|
|
beforeAll(() => {
|
|
root = mkdtempSync(join(tmpdir(), 'jsonb-guard-'));
|
|
badDir = join(root, 'bad');
|
|
goodDir = join(root, 'good');
|
|
mkdirSync(badDir, { recursive: true });
|
|
mkdirSync(goodDir, { recursive: true });
|
|
|
|
// BAD: positional $1::jsonb bound to a JSON.stringify'd value.
|
|
writeFileSync(
|
|
join(badDir, 'bad.ts'),
|
|
"await engine.executeRaw(`INSERT INTO t (a) VALUES ($1::jsonb)`, [JSON.stringify(x)]);\n",
|
|
);
|
|
// BAD: generic-typed executeRaw<T>(...) must still be caught.
|
|
writeFileSync(
|
|
join(badDir, 'bad_generic.ts'),
|
|
"await engine.executeRaw<{ id: string }>(`UPDATE t SET a = $2::jsonb WHERE id = $1`, [id, JSON.stringify(x)]);\n",
|
|
);
|
|
|
|
// GOOD: the fix — $1::text::jsonb.
|
|
writeFileSync(
|
|
join(goodDir, 'good_text.ts'),
|
|
"await engine.executeRaw(`INSERT INTO t (a) VALUES ($1::text::jsonb)`, [JSON.stringify(x)]);\n",
|
|
);
|
|
// GOOD: text[] array path (the appendCompleted unnest shape).
|
|
writeFileSync(
|
|
join(goodDir, 'good_array.ts'),
|
|
"await engine.executeRaw(`INSERT INTO t (a) SELECT unnest($1::text[])`, [JSON.stringify(arr)]);\n",
|
|
);
|
|
// GOOD: executeRawJsonb passes a raw object, not a string — excluded.
|
|
writeFileSync(
|
|
join(goodDir, 'good_helper.ts'),
|
|
"await executeRawJsonb(engine, `INSERT INTO t (a) VALUES ($1::jsonb)`, [], [JSON.stringify(x)]);\n",
|
|
);
|
|
// GOOD: explicit opt-out for a rare legitimate object-binding case.
|
|
writeFileSync(
|
|
join(goodDir, 'good_optout.ts'),
|
|
"await engine.executeRaw(`INSERT INTO t (a) VALUES ($1::jsonb)` /* jsonb-guard-ok */, [JSON.stringify(x)]);\n",
|
|
);
|
|
});
|
|
|
|
afterAll(() => {
|
|
rmSync(root, { recursive: true, force: true });
|
|
});
|
|
|
|
describe('check-jsonb-params guard', () => {
|
|
test('flags positional $N::jsonb + JSON.stringify (incl. generic-typed calls)', () => {
|
|
const { code, err } = runGuard(badDir);
|
|
expect(code).toBe(1);
|
|
expect(err).toContain('bad.ts');
|
|
expect(err).toContain('bad_generic.ts');
|
|
});
|
|
|
|
test('passes the sanctioned forms (::text::jsonb, ::text[], executeRawJsonb, opt-out)', () => {
|
|
const { code, err } = runGuard(goodDir);
|
|
expect(code).toBe(0);
|
|
expect(err).toContain('clean');
|
|
});
|
|
});
|