From 6d8b6ac774e2feeb41f3d5754ce0f887475a0956 Mon Sep 17 00:00:00 2001 From: vycdev2 Date: Thu, 17 Sep 2026 07:04:56 +0000 Subject: [PATCH] fix: reject non-decimal numeric config values --- CHANGELOG.md | 1 + src/config.ts | 7 +++++-- tests/configLimits.test.mjs | 10 ++++++++++ 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 478ebd9..a942865 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ ### Fixed +- Reject exponent, hexadecimal, and signed syntax in non-negative integer environment settings instead of interpreting them as decimal configuration values. - Preserve embed titles, descriptions, and URLs in live MCP `read-messages` results. - Prevent `!guild` server-memory responses from triggering Discord mentions from stored memory or server names. - Verify recent, legacy, and full-text-search history reads before assembling model context; reject symbolic-link files and replaced storage directories. diff --git a/src/config.ts b/src/config.ts index 088ac34..2663e68 100644 --- a/src/config.ts +++ b/src/config.ts @@ -165,9 +165,12 @@ function parseNonNegativeInteger( fallback: number, maximum = Number.MAX_SAFE_INTEGER, ): number { - if (value === undefined || value.trim() === "") return fallback; + if (value === undefined) return fallback; - const parsed = Number(value); + const normalized = value.trim(); + if (!/^\d+$/.test(normalized)) return fallback; + + const parsed = Number(normalized); return Number.isSafeInteger(parsed) && parsed >= 0 && parsed <= maximum ? parsed : fallback; diff --git a/tests/configLimits.test.mjs b/tests/configLimits.test.mjs index 835c295..8cff2f3 100644 --- a/tests/configLimits.test.mjs +++ b/tests/configLimits.test.mjs @@ -146,6 +146,16 @@ test("context limits fall back for malformed values", () => { ); }); +test("context limits reject non-decimal integer syntax", () => { + assert.deepEqual( + readConfigValues( + ["LIVE_CONTEXT_LIMIT", "DEEP_LIVE_CONTEXT_LIMIT", "HISTORY_RECENT_LINES"], + ["1e2", "0x10", "+5"], + ), + [35, 500, 80], + ); +}); + test("context limits preserve valid integers including zero", () => { assert.deepEqual(readLimits(["0", "1", "2", "3", "4", "5", "6", "12345"]), [ 0,