github-featured / composiohq--composio

发布

RSS 订阅源

@composio/cli@0.2.33-beta.297 2dc9ef34d0

比较
fix(cli): remove `new Function()` eval from JSON-ish input parsing (#3878)

frostbyte_neo 发布于 2026-07-21 07:14:55 +00:00
This PR:
- removes an in-process arbitrary-code-execution surface:
  parse-json-ish.ts fell back to Function("return (…)")() for any
  tools execute --data, listen --params, or proxy body value that
  failed JSON and comment-JSON parsing — the CLI is agent-facing and
  --data also accepts @file and stdin, so crafted or prompt-injected
  input reached the eval
- lands the parser in its final consolidated shape:
  src/utils/parse-json.ts parses JSON5 (unquoted keys, single quotes,
  trailing commas, comments) without evaluating anything and returns
  Either with a typed JsonParsingError
- consolidates the effect-errors read-json duplicates onto the same
  parser and swaps comment-json for json5 (the stack's only lockfile
  change)
- pins code-execution probes in unit tests (new Date(), computed
  expressions, globalThis writes are rejected, never evaluated)
- intentional narrowing: JS expressions such as 1+1 that only worked
  because of the eval now fail with a parse error; proxy bodies that are
  not JSON5 records fall back to the raw string
Stack (re-slice of https://github.com/ComposioHQ/composio/pull/3859;
each PR targets its parent and auto-retargets to next as parents
merge):
1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert
  rule groups
2. https://github.com/ComposioHQ/composio/pull/3878 — new Function()
  eval security fix ← this PR
3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix
  pack
4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports
  rule + migration
5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams
  rule + TerminalUI boundary
6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam +
  zod→Schema
7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint +
  deterministic suites
8. https://github.com/ComposioHQ/composio/pull/3884 — typed error
  boundaries + v4 seams
9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban
- boundary ratchet
On stacked bases CI runs lint/build and the CLI Docker e2e job; unit
tests and typecheck are verified locally per PR and re-verified by full
CI when each PR is retargeted to next.
下载附件
- 源代码 (ZIP)
- 源代码 (TAR.GZ)

0 发布 1,233 Git 标签

fix(cli): remove `new Function()` eval from JSON-ish input parsing (#3878)