From b9c77bb6f9b8b83574489344ef6efd207a611e98 Mon Sep 17 00:00:00 2001 From: amankumarsingh77 Date: Tue, 28 Jul 2026 00:53:19 +0530 Subject: refactor: validate JSON at every parse boundary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ten sites cast or implicitly typed JSON.parse output; JSON.parse("null") would have satisfied all of them. parseJson returns a Result and validates against a typebox schema. js.ts keeps unknown — user script output has no fixed shape. daemon/bridge.ts assigned JSON.parse straight to CdpRawMessage with no guard at all; it now uses isCdpRawMessage like the transport does. Co-Authored-By: Claude Opus 5 (1M context) --- src/cdp/discovery.ts | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) (limited to 'src/cdp') diff --git a/src/cdp/discovery.ts b/src/cdp/discovery.ts index 295df20..b4be31c 100644 --- a/src/cdp/discovery.ts +++ b/src/cdp/discovery.ts @@ -2,6 +2,9 @@ import { readFile, stat } from "node:fs/promises"; import { join } from "node:path"; import { connect as netConnect } from "node:net"; import { request as httpRequest } from "node:http"; +import { Type } from "typebox"; +import { Compile } from "typebox/compile"; +import { parseJson } from "../schemas/parse"; import { type Result, err, ok } from "../util/result"; import { userDataDirCandidates } from "../profile/paths"; import { type CdpError, cdpError } from "./errors"; @@ -9,6 +12,13 @@ import { type CdpError, cdpError } from "./errors"; const PORT_PROBE_DEADLINE_MS = 30_000; const PORT_PROBE_INTERVAL_MS = 1_000; +const VersionResponse = Type.Object( + { webSocketDebuggerUrl: Type.Optional(Type.String()) }, + { additionalProperties: true }, +); + +const versionValidator = Compile(VersionResponse); + /** * A live CDP endpoint plus, when discovery went through a DevToolsActivePort * file, the user-data-dir that file lives in. That directory is the browser's @@ -76,13 +86,8 @@ const queryLiveWsUrl = (port: number, timeoutMs = 1_500): Promise const chunks: Buffer[] = []; res.on("data", (c: Buffer) => chunks.push(c)); res.on("end", () => { - try { - const json = JSON.parse(Buffer.concat(chunks).toString("utf8")) as Record; - const ws = json["webSocketDebuggerUrl"]; - resolve(typeof ws === "string" ? ws : null); - } catch { - resolve(null); - } + const parsed = parseJson(Buffer.concat(chunks).toString("utf8"), versionValidator); + resolve(parsed.success ? parsed.data.webSocketDebuggerUrl ?? null : null); }); }, ); -- cgit v1.2.3