[PR #1029] [MERGED] fix(domain): reject excessive JSON depth with actionable diagnostics #2593

New issue

Closed

opened 2026-10-17 21:07:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:07:58 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1029
Author: @DeryFerd
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/json-depth-and-payload-bounds

📝 Commits (4)

f6b98c1 fix(domain): bound JSON depth and oversized payloads at parsing boundaries
325eb97 Merge remote-tracking branch 'origin/main' into maintain/pr-1029
1c1db04 Merge remote-tracking branch 'origin/main' into maintain/pr-1029
63a2601 fix(validation): preserve depth diagnostics across process inputs

📊 Changes

10 files changed (+277 additions, -12 deletions)

View changed files

📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 src/application/process/ProcessCli.ts (+7 -0)
➕ src/domain/apple/keyedArchive.test.ts (+27 -0)
📝 src/domain/evidence.test.ts (+25 -0)
📝 src/domain/jsonValue.test.ts (+66 -2)
📝 src/domain/jsonValue.ts (+56 -2)
📝 tests/boundary/cli/processCli.test.ts (+55 -3)
📝 tests/boundary/mcp/sessionMcp.test.ts (+36 -0)

📄 Description

Deeply nested JSON could throw RangeError from safeParse, escaping normal validation. An iterative guard now rejects values over 1,000 nesting edges before recursive JSON validation, including cyclic input. CLI capture comparison preserves the resulting field and constraint diagnostics through the existing typed error projection.

Regression coverage includes the original 10,000-level object/array triggers, Evidence and keyed-archive inputs, and complete process-capture Evidence over MCP and the compiled CLI. Successful comparisons establish the fixtures before only a nested parameter is changed. Advertised JSON schemas retain the nonrecursive projection required by clients.

Validation:

46 focused JSON, Evidence, keyed-archive, MCP, CLI, and contract-presentation tests pass.
16 JSON/SDK schema tests pass after integration with latest main.
npm run check, npm run docs:generate, and npm run docs:check pass.

Real Hopper/Ghidra verification was not performed. Native Apple and packaged-platform checks run in CI. No linked issue was found for the original depth crash.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1029 **Author:** [@DeryFerd](https://github.com/DeryFerd) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/json-depth-and-payload-bounds` --- ### 📝 Commits (4) - [`f6b98c1`](https://github.com/morluto/rea/commit/f6b98c1f33e9db2d6a740847121f80e3b09efd02) fix(domain): bound JSON depth and oversized payloads at parsing boundaries - [`325eb97`](https://github.com/morluto/rea/commit/325eb970d404a7f9eb509e6232cb5d680e7bd107) Merge remote-tracking branch 'origin/main' into maintain/pr-1029 - [`1c1db04`](https://github.com/morluto/rea/commit/1c1db04fcea266a72ecf850168d329177ead3933) Merge remote-tracking branch 'origin/main' into maintain/pr-1029 - [`63a2601`](https://github.com/morluto/rea/commit/63a260151f33655d5e0372826cd4dbd015017289) fix(validation): preserve depth diagnostics across process inputs ### 📊 Changes **10 files changed** (+277 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `src/application/process/ProcessCli.ts` (+7 -0) ➕ `src/domain/apple/keyedArchive.test.ts` (+27 -0) 📝 `src/domain/evidence.test.ts` (+25 -0) 📝 `src/domain/jsonValue.test.ts` (+66 -2) 📝 `src/domain/jsonValue.ts` (+56 -2) 📝 `tests/boundary/cli/processCli.test.ts` (+55 -3) 📝 `tests/boundary/mcp/sessionMcp.test.ts` (+36 -0) </details> ### 📄 Description Deeply nested JSON could throw `RangeError` from `safeParse`, escaping normal validation. An iterative guard now rejects values over 1,000 nesting edges before recursive JSON validation, including cyclic input. CLI capture comparison preserves the resulting field and constraint diagnostics through the existing typed error projection. Regression coverage includes the original 10,000-level object/array triggers, Evidence and keyed-archive inputs, and complete process-capture Evidence over MCP and the compiled CLI. Successful comparisons establish the fixtures before only a nested parameter is changed. Advertised JSON schemas retain the nonrecursive projection required by clients. Validation: - 46 focused JSON, Evidence, keyed-archive, MCP, CLI, and contract-presentation tests pass. - 16 JSON/SDK schema tests pass after integration with latest main. - `npm run check`, `npm run docs:generate`, and `npm run docs:check` pass. Real Hopper/Ghidra verification was not performed. Native Apple and packaged-platform checks run in CI. No linked issue was found for the original depth crash. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:07:58 +00:00