WorkRoot/WRNexusJS
2
0
Fork 0
Code Issues Pull Requests Actions 23 Packages Projects Releases Wiki Activity

fix(rpc): close prototype-chain permission bypass, add server/client/transport tests

Browse Source 
C1 CRITICAL: implement() looked up procedures/handlers with plain property
indexing, so any Object.prototype member name (constructor, toString, etc.)
resolved truthy and skipped the permission gate entirely. Fixed with
Object.hasOwn checks in packages/rpc/src/server.ts. Defense-in-depth guard
added in packages/dev-server/src/rpc-dispatch.ts constraining URL path
segments to a safe charset before they reach service/procedure lookups.

Added missing direct test coverage for packages/rpc/src/transport.ts,
server.ts and client.ts (previously untested), including a prototype-name
sweep in both server.test.ts and dev-server's rpc-endpoint.test.ts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Clintchiz
2026-08-05 19:46:59 +05:30
co-authored by Claude Opus 5
parent fcf4ed3039
commit 7c4b484d0a
6 changed files with 468 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/dev-server/src/rpc-dispatch.ts
+5 -2
View File
@@ -27,9 +27,12 @@ export async function handleRpcRequest(
if (!isInternalCaller(req)) return new Response("Not found", { status: 404 });
if (req.method !== "POST") return new Response("Method not allowed", { status: 405 });
const segments = url.pathname.split("/");
const service = segments[3] ? services.get(segments[3]) : undefined;
const SAFE_SEGMENT = /^[A-Za-z0-9_-]+$/;
const serviceName = segments[3];
const procedure = segments[4];
if (!service || !procedure || segments.length !== 5) {
const service =
serviceName && SAFE_SEGMENT.test(serviceName) ? services.get(serviceName) : undefined;
if (!service || !procedure || !SAFE_SEGMENT.test(procedure) || segments.length !== 5) {
return json({ ok: false, code: "RPC_UNKNOWN", message: "Unknown procedure", retryable: false });
}
let payload: unknown;