fix(web_core): validate component properties against catalog schema in message processor - #2142
Merged
gspencergoog merged 5 commits intoJul 31, 2026
Conversation
…n message processor Validate incoming component properties against the component's catalog schema in MessageProcessor.processUpdateComponentsMessage. Malformed component payloads (such as malformed actions with direct "call" properties) are rejected immediately with an A2uiValidationError. Also update CheckableSchema to include optional isValid and validationErrors fields so component validation states can be provided in properties, and make action optional on ButtonApi.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
… Zod errors Address PR feedback: 1. Format Zod errors into clean, human-readable strings. 2. Separate processUpdateComponentsMessage into a validation pass and a mutation pass to guarantee atomic state updates.
gspencergoog
force-pushed
the
fix-malformed-action-validation
branch
2 times, most recently
from
July 31, 2026 21:36
9bf018e to
074ddc8
Compare
…mon-types for closure compiler compatibility Closure Compiler (1P advanced minification) renames unquoted object keys in Zod schemas (e.g. children, justify, align -> a, b, c), causing safeParse on incoming JSON objects to fail. Quoting the property keys ensures Closure Compiler preserves them.
gspencergoog
force-pushed
the
fix-malformed-action-validation
branch
from
July 31, 2026 21:39
074ddc8 to
03505b1
Compare
…api for closure compiler compatibility Quote all property keys in DataBindingSchema, FunctionCallSchema, ChildListSchema, ActionSchema, CheckRuleSchema, and basic function argument schemas so Closure Compiler does not minify key names during advanced optimization builds.
nan-yu
approved these changes
Jul 31, 2026
nan-yu
left a comment
nan-yu
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. This has been identified as a missing coverage in the current MessageProcessor, https://docs.google.com/document/d/17BuULV88IlsUStOFthGMgfeW1XMtLUyQDm3oflgXi-k/edit?pli=1&resourcekey=0-fltDWdFS4VEdDHSTzq--QA&tab=t.lcmh7rwipp8t#bookmark=id.576fjubtmldj.
The new web a2ui_core will run more sophisticated validation, including catalog schema checks, and more.
Collaborator
Author
Oh, good! |
Collaborator
|
I'm surprised there's not an existing issue for this very thing on the web renderers, but I can't find it :/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes an issue where malformed component properties (such as specifying
"action": { "call": "openUrl", "args": { "url": "..." } }instead of a valid event or wrapped function call) were accepted into component models without schema validation, causingDataContextto immediately execute function calls on component mount without user interaction.Changes
MessageProcessor): Validate incoming component properties againstsurface.catalog.components.get(componentType)?.schemainprocessUpdateComponentsMessage. ThrowsA2uiValidationErrorif validation fails.common-types.ts,basic_components.ts):isValidandvalidationErrorsfields toCheckableSchemaand spread...CheckableSchema.shapeacross checkable components.actionoptional (ActionSchema.optional()) onButtonApi.message-processor.test.tsto verify rejection of malformed component properties.style: "italic"property.Verification
yarn workspace @a2ui/web_core test(281 tests passing)yarn workspace @a2ui/lit test:unit(96 tests passing)yarn workspace @a2ui/react test(passing)yarn workspace @a2ui/angular test:unit(256 tests passing)