Repository navigation
fix(cli,transport): reject duplicate JSON keys, non-finite constants, and non-string coercion in CLI and HTTP transport (#272) - #275
Conversation
… and non-string coercion in CLI and HTTP transport (agentrust-io#272) - Reject duplicate JSON object keys and NaN/Infinity constants in server.py (/ca2a/task), client.py (_get_json / _post_json), and cli.py (_load_chain, _load_records, _cmd_verify_lineage). - Require strict string and list types in cli._load_records and validate decision in {"allow", "deny"} in DelegationRecord.__post_init__. Closes agentrust-io#272 Signed-off-by: Raghuvar Durga <177662415+drk-ram@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head c36e4bb40037199f49dfc8b069f7eb96a5ca587e in an isolated checkout.
The CLI and unauthenticated HTTP JSON boundaries now reject duplicate members/non-finite constants, and required record/offer identifiers are checked as strings rather than coerced with str(). The authenticated task route retains its existing canonical decoder. No blocking source finding in the changed paths.
Fresh hash-locked Python 3.12.10 validation: 777 unit tests passed, 16 skipped; pip check, Ruff, mypy and Bandit passed. Sign-offs are present. git diff --check reports an extra blank line at test_lineage_cli.py EOF only. Required hosted checks and maintainer gates still need completion.
Reviewed with OpenAI Codex.
What
Reject duplicate JSON object keys and non-finite constants (
NaN,Infinity) acrossca2a_runtime.cli,ca2a_runtime.transport.server(/ca2a/task), andca2a_runtime.transport.client, and enforce strict field types incli._load_recordsandDelegationRecord.__post_init__.Why
Closes #272.
Security impact
Prevents duplicate-key JSON smuggling on
/ca2a/task, HTTP client responses, and CLI chain/DAG files, and preventscli._load_recordsfrom splitting a stringscopeinto single-character capabilities or coercing non-string fields viastr(...).Test plan
pytestpasses (pytest tests/unit/test_lineage_cli.py tests/unit/test_live_call.py tests/unit/test_provenance.py -q:58 passed)ruff checkpasses (ruff check src/ca2a_runtime/provenance.py src/ca2a_runtime/cli.py src/ca2a_runtime/transport/server.py src/ca2a_runtime/transport/client.py tests/unit/test_lineage_cli.py:All checks passed!)mypypasses (mypy src/ca2a_runtime/provenance.py src/ca2a_runtime/cli.py src/ca2a_runtime/transport/server.py src/ca2a_runtime/transport/client.py:Success)DCO sign-off
Developer Certificate of Origin (https://developercertificate.org).