Skip to content

fix(security): parseMeta in observer.ts silently casts non-object JSON to Record type #306

@vamgan

Description

@vamgan

Summary

parseMeta() in packages/core/src/observer.ts used JSON.parse(raw) as Record<string, unknown> without validating the parsed type. If a data-askable attribute contains valid JSON that is not a plain object — e.g. data-askable="42", data-askable="[1,2,3]", data-askable="null" — the value would be unsafely cast to Record<string, unknown> at compile time but would be a number, array, or null at runtime.

Downstream code that calls Object.entries(meta) or accesses properties on meta would receive unexpected values, potentially causing runtime errors or incorrect context output.

Impact

If the data-askable attribute contains a non-object JSON primitive, focus tracking could produce malformed context objects. Severity is low because the attribute is set by application developers, not end users.

Fix

Validate the JSON.parse result: if it's not a plain object (non-null, not an array), fall back to the raw string — matching the explicit | string return type.

Fixed in: claude/create-agents-md-fqfEf

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecurity

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions