fix: Look up DeepHashAccessor keys instead of defining methods - #580
Open
razor-x wants to merge 1 commit into
Open
fix: Look up DeepHashAccessor keys instead of defining methods#580razor-x wants to merge 1 commit into
razor-x wants to merge 1 commit into
Conversation
DeepHashAccessor defined a singleton method for every key of the hash it wrapped, so caller-controlled data such as custom_metadata could shadow the object's own methods: a "to_h" key replaced to_h, which the action attempt resolver calls on the client defaults, and a "class" key replaced class. Subscript access also leaked every public method, so accessor["to_h"] returned the data whether or not that key existed. Keep the processed values in a hash and serve reads through method_missing and respond_to_missing?, so a key can never replace a method and subscript access reads only the data. Also drop the unused require of date. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQW83gyXeUG61RDrHEky97
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SDK audit finding M10 (second part).
DeepHashAccessor#create_accessor_methodscalleddefine_singleton_methodfor every key of the wrapped hash.custom_metadataand every undeclared nested object are wrapped this way, so caller-controlled keys shadowed the object's own methods: a"to_h"key replacedto_h(whichActionAttemptResolver.wait_optionscalls on the client defaults), a"class"key replacedclass, and so on. Subscript access wasrespond_to?-based, soaccessor["to_h"]returned the data whether or not that key existed.Fix
Processed values live in a string-keyed hash; reads go through
method_missing/respond_to_missing?, so a key can never replace a method, and[]reads only the data. Memoization of nested accessors is preserved. Also drops the unusedrequire "date".Tests
spec/deep_hash_accessor_spec.rb:respond_to?reflects keys only, a key called with arguments still raisesNoMethodError,to_handclasskeep their meaning whileaccessor["to_h"]andaccessor["class"]return the data, andaccessor["inspect"]is nil.Revert-check against
main: 4 failures, withto_handclassreturning"shadow"andaccessor["inspect"]returning the inspect string.🤖 Generated with Claude Code
https://claude.ai/code/session_01SQW83gyXeUG61RDrHEky97
Generated by Claude Code