morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #189] fix(application): traverse bounded JSON values correctly in readBoundedJson #135

New issue

Closed

opened 2026-10-15 18:21:28 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:21:28 +00:00

Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/189

Problem

readBoundedJson enforces EvidenceFilePolicy limits through validateJsonLimits before returning JSON data. Inside the object traversal loop, the code pushes the current object back into the stack instead of each child value.

Evidence

File: src/application/BoundedJsonFiles.ts
In validateJsonLimits, the loop is currently:

for (const [key, value] of Object.entries(current.value)) {
  if (key.length > policy.maxStringLength) return false;
  pending.push({ value: current.value, depth: current.depth + 1 });
}

It should push value, not current.value.

Impact

Nested objects/arrays are effectively never descended into as intended.
Bounded JSON checks can trip maxNodes/maxDepth incorrectly due to re-queueing the same parent object.
Valid bounded payloads can be rejected as too large or malformed for policy enforcement.

Suggested fix

In src/application/BoundedJsonFiles.ts, replace:

pending.push({ value: current.value, depth: current.depth + 1 });

with

pending.push({ value, depth: current.depth + 1 });

Add/adjust regression tests for nested JSON traversal under policy limits.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/189 ## Problem `readBoundedJson` enforces `EvidenceFilePolicy` limits through `validateJsonLimits` before returning JSON data. Inside the object traversal loop, the code pushes the current object back into the stack instead of each child value. ## Evidence - File: `src/application/BoundedJsonFiles.ts` - In `validateJsonLimits`, the loop is currently: ```ts for (const [key, value] of Object.entries(current.value)) { if (key.length > policy.maxStringLength) return false; pending.push({ value: current.value, depth: current.depth + 1 }); } ``` It should push `value`, not `current.value`. ## Impact - Nested objects/arrays are effectively never descended into as intended. - Bounded JSON checks can trip `maxNodes`/`maxDepth` incorrectly due to re-queueing the same parent object. - Valid bounded payloads can be rejected as too large or malformed for policy enforcement. ## Suggested fix In `src/application/BoundedJsonFiles.ts`, replace: ```ts pending.push({ value: current.value, depth: current.depth + 1 }); ``` with ```ts pending.push({ value, depth: current.depth + 1 }); ``` Add/adjust regression tests for nested JSON traversal under policy limits.

bsakaguchi

2026-10-15 18:21:28 +00:00

closed this issue
added the
bug
label

bsakaguchi commented

2026-10-15 18:21:30 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Jul 14, 2026):

Triage on current main (6a3fd5b): this report is not reproducible. validateJsonLimits has pushed the child value (not current.value) since its introduction in c439b9e. The nested/depth evidence read coverage passes in the full suite. The related deduplication work in #193 will preserve this behavior with shared regression coverage, but there is no #189 bug to fix.

@N0zoM1z0 commented on GitHub (Jul 14, 2026): Triage on current `main` (`6a3fd5b`): this report is not reproducible. `validateJsonLimits` has pushed the child `value` (not `current.value`) since its introduction in `c439b9e`. The nested/depth evidence read coverage passes in the full suite. The related deduplication work in #193 will preserve this behavior with shared regression coverage, but there is no #189 bug to fix.

bsakaguchi referenced this issue

2026-10-16 21:11:48 +00:00

[PR #203] [MERGED] fix: resolve triaged correctness issues #1854

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#135

No description provided.

Rows
Columns