From b9c77bb6f9b8b83574489344ef6efd207a611e98 Mon Sep 17 00:00:00 2001 From: amankumarsingh77 Date: Tue, 28 Jul 2026 00:53:19 +0530 Subject: refactor: validate JSON at every parse boundary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ten sites cast or implicitly typed JSON.parse output; JSON.parse("null") would have satisfied all of them. parseJson returns a Result and validates against a typebox schema. js.ts keeps unknown — user script output has no fixed shape. daemon/bridge.ts assigned JSON.parse straight to CdpRawMessage with no guard at all; it now uses isCdpRawMessage like the transport does. Co-Authored-By: Claude Opus 5 (1M context) --- src/daemon/bridge.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src/daemon/bridge.ts') diff --git a/src/daemon/bridge.ts b/src/daemon/bridge.ts index 33ef63b..de6dec7 100644 --- a/src/daemon/bridge.ts +++ b/src/daemon/bridge.ts @@ -12,6 +12,7 @@ import WebSocket from "ws"; import { discoverWsUrl } from "../cdp/discovery"; +import { isCdpRawMessage } from "../cdp/types"; import type { CdpRawMessage } from "../cdp/types"; import type { WireRequest, WireResponse, WireEvent } from "./protocol"; import { CDP_CONNECT_TIMEOUT_MS, CDP_COMMAND_TIMEOUT_MS } from "./protocol"; @@ -150,8 +151,10 @@ export const createCdpBridge = (): CdpBridge => { // ── Handle raw CDP messages from Chrome ───────────────────────────────── const onChromeMessage = (raw: string): void => { - let msg: CdpRawMessage; - try { msg = JSON.parse(raw); } catch { return; } + let parsed: unknown; + try { parsed = JSON.parse(raw); } catch { return; } + if (!isCdpRawMessage(parsed)) return; + const msg: CdpRawMessage = parsed; // ---- Response (has id) ---- if (msg.id !== undefined) { -- cgit v1.2.3