[PR #1049] [MERGED] fix(domain): preserve prototype-named JSON members through Evidence boundaries #2607

New issue

Closed

opened 2026-10-17 21:08:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:09 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1049
Author: @sx4im
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/jsonvalue-prototype-named-members

📝 Commits (7)

27f2ab2 fix(domain): preserve prototype-named JSON members through Evidence boundaries
f6b98c1 fix(domain): bound JSON depth and oversized payloads at parsing boundaries
325eb97 Merge remote-tracking branch 'origin/main' into maintain/pr-1029
1c1db04 Merge remote-tracking branch 'origin/main' into maintain/pr-1029
63a2601 fix(validation): preserve depth diagnostics across process inputs
489b06e fix(json): preserve and validate all JSON evidence members
cdea212 Merge remote-tracking branch 'origin/main' into maintain/pr-1049

📊 Changes

15 files changed (+203 additions, -83 deletions)

View changed files

📝 bridge/mitmproxy/capture.py (+0 -2)
📝 docs/product-catalog.json (+2 -2)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 docs/web-network-captures.md (+3 -3)
📝 scripts/verify-web-network-captures.mjs (+10 -8)
📝 skills/reverse-engineer-anything/SKILL.md (+1 -1)
📝 src/browser/history/HarCapture.test.ts (+18 -4)
📝 src/browser/history/HarJson.ts (+3 -5)
📝 src/contracts/webNetworkCaptureToolContracts.ts (+1 -1)
📝 src/domain/evidence.test.ts (+39 -1)
📝 src/domain/evidence.ts (+6 -2)
📝 src/domain/javascript/javascriptSemanticQuerySchemas.ts (+13 -8)
📝 src/domain/jsonValue.test.ts (+31 -0)
📝 src/domain/jsonValue.ts (+63 -43)
📝 tests/boundary/mcp/webNetworkCaptureMcp.test.ts (+11 -1)

📄 Description

JSON parsing silently dropped prototype-named members, changing retained Evidence and its semantic identity. JSON boundaries now validate every own member before cloning with safe data-property construction, preserving __proto__, constructor, escaped names, and nested values. Invalid JSON hidden under those names is rejected; the existing 1,000-edge depth guard and nonrecursive advertised schemas remain enforced.

Evidence parameter maps use the same preserving object boundary. HAR and native mitmproxy captures retain these members through CLI/MCP output; the native bridge’s obsolete refusal is removed. The real capture verifier checks retained producer fields and unchanged capture files for both formats.

Validation:

Focused JSON/Evidence/HAR, CLI/MCP, identity, schema, and contract-presentation tests pass.
npm run check, generated-document regeneration/checks, and Python syntax validation pass.
All 11 reviewed source files remain identical after main integration; SDK schema and capture tests pass on the integrated tree.
Local native mitmproxy verification is unavailable because mitmdump is not installed; the corresponding real-tool CI lane is required before merge.

Real Hopper/Ghidra verification was not performed.

Fixes #1036.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1049 **Author:** [@sx4im](https://github.com/sx4im) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/jsonvalue-prototype-named-members` --- ### 📝 Commits (7) - [`27f2ab2`](https://github.com/morluto/rea/commit/27f2ab20e6a3f1d7061aa51f58c81d6f13437eed) fix(domain): preserve prototype-named JSON members through Evidence boundaries - [`f6b98c1`](https://github.com/morluto/rea/commit/f6b98c1f33e9db2d6a740847121f80e3b09efd02) fix(domain): bound JSON depth and oversized payloads at parsing boundaries - [`325eb97`](https://github.com/morluto/rea/commit/325eb970d404a7f9eb509e6232cb5d680e7bd107) Merge remote-tracking branch 'origin/main' into maintain/pr-1029 - [`1c1db04`](https://github.com/morluto/rea/commit/1c1db04fcea266a72ecf850168d329177ead3933) Merge remote-tracking branch 'origin/main' into maintain/pr-1029 - [`63a2601`](https://github.com/morluto/rea/commit/63a260151f33655d5e0372826cd4dbd015017289) fix(validation): preserve depth diagnostics across process inputs - [`489b06e`](https://github.com/morluto/rea/commit/489b06efc5fd1d418aaeb1b2c05992f4c1f2be55) fix(json): preserve and validate all JSON evidence members - [`cdea212`](https://github.com/morluto/rea/commit/cdea2124c43dfe25ecc64e0bd3bf57f4842464f5) Merge remote-tracking branch 'origin/main' into maintain/pr-1049 ### 📊 Changes **15 files changed** (+203 additions, -83 deletions) <details> <summary>View changed files</summary> 📝 `bridge/mitmproxy/capture.py` (+0 -2) 📝 `docs/product-catalog.json` (+2 -2) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `docs/web-network-captures.md` (+3 -3) 📝 `scripts/verify-web-network-captures.mjs` (+10 -8) 📝 `skills/reverse-engineer-anything/SKILL.md` (+1 -1) 📝 `src/browser/history/HarCapture.test.ts` (+18 -4) 📝 `src/browser/history/HarJson.ts` (+3 -5) 📝 `src/contracts/webNetworkCaptureToolContracts.ts` (+1 -1) 📝 `src/domain/evidence.test.ts` (+39 -1) 📝 `src/domain/evidence.ts` (+6 -2) 📝 `src/domain/javascript/javascriptSemanticQuerySchemas.ts` (+13 -8) 📝 `src/domain/jsonValue.test.ts` (+31 -0) 📝 `src/domain/jsonValue.ts` (+63 -43) 📝 `tests/boundary/mcp/webNetworkCaptureMcp.test.ts` (+11 -1) </details> ### 📄 Description JSON parsing silently dropped prototype-named members, changing retained Evidence and its semantic identity. JSON boundaries now validate every own member before cloning with safe data-property construction, preserving `__proto__`, `constructor`, escaped names, and nested values. Invalid JSON hidden under those names is rejected; the existing 1,000-edge depth guard and nonrecursive advertised schemas remain enforced. Evidence parameter maps use the same preserving object boundary. HAR and native mitmproxy captures retain these members through CLI/MCP output; the native bridge’s obsolete refusal is removed. The real capture verifier checks retained producer fields and unchanged capture files for both formats. Validation: - Focused JSON/Evidence/HAR, CLI/MCP, identity, schema, and contract-presentation tests pass. - `npm run check`, generated-document regeneration/checks, and Python syntax validation pass. - All 11 reviewed source files remain identical after main integration; SDK schema and capture tests pass on the integrated tree. - Local native mitmproxy verification is unavailable because mitmdump is not installed; the corresponding real-tool CI lane is required before merge. Real Hopper/Ghidra verification was not performed. Fixes #1036. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:09 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2607

No description provided.

Rows
Columns