Repository navigation
fix(admin): cap configuration value nesting at 1,000 levels explicitly - #2082
Merged
Merged
Conversation
parseConfigValue relied on JSON.stringify throwing to refuse deeply nested values. Node 26's V8 parses and stringifies 100,000 levels without throwing, so the 100,000-deep value was accepted and the test crashed with a RangeError inside toEqual while comparing it. That broke every Verify PR run and stage's own deploy. Count depth in the existing iterative walk and refuse past MAX_CONFIG_DEPTH (1,000 nested arrays or objects) with the same message, whatever the engine allows. The now-unreachable try/catch around JSON.stringify goes. The test asserts on .ok and .error separately, so a regression fails by assertion instead of crashing, and pins the boundary for arrays and objects plus a wide-but-shallow value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review round 1 found the comments restated code or narrated the next assertion. Keep only why the depth is counted and why the test avoids toEqual. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
⊙ Problem
stageCI is red, and so is every PR's Verify PR run. The Configuration page'sparseConfigValuerelied onJSON.stringifythrowing to refuse deeply nested values. Node 26 parses and stringifies 100,000 levels without throwing, so the value was accepted and the test crashed withRangeError: Maximum call stack size exceededinsidetoEqual.💡 Solution
index.tsx, the walk that already checks numbers now counts depth too. It refuses more thanMAX_CONFIG_DEPTH(1,000) nested arrays or objects with the same "nested too deeply" message, on any engine.JSON.stringifytry/catch is gone, since nothing can reach it now.JSON.parseoutput can only make it throw by running out of stack, which 1,000 levels does not).🤔 The cap is Studio-only, at 1,000
central-manager accepts any value (
Joi.any()invalidatePatchConfiguration), so a direct API call can still store deeper values. A server-side cap would be a separate central-manager change. 1,000 is the depth #1988 already accepted and tested. A lower cap could refuse an existing value when someone edits it.✅ Verification
.nvmrcpin) the old test crashes with theRangeError. With the fix it passes.index.test.tsxnow checks.okand.erroron their own, so a regression fails an assertion instead of crashing. Removing the guard, raising the limit by one, and counting size instead of depth each fail it with anAssertionError.tsc -band oxlint all pass.dprint checkflagsAdminShell.tsxandadminShellVisibility.test.ts, which are already unformatted onstageand not part of this PR. CI doesn't rundprint check.🤖 Generated with Claude Code
Related PRs: #2065 overlaps (carries its own copy of this fix, with the same 1,000 limit; it should drop that copy when it rebases), 1 others independent
Complexity: easy
Review-Coverage: authored=claude; ran=cursor-composer,codex,gemini; adjudicated=domain; declined=cursor-grok,muse; urgency=fast; rounds=2; full=1 @ c13b28c
Review-Attention: read ~3m (decisions: client-only-depth-cap, depth-cap-value) @ c13b28c