MemberJunction / MemberJunction/MJ
Security: JSON Parsing Vulnerabilities in Loop Agent
- Dominant language
- TSQL
- Stars
- 29
- Forks
- 6
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 323
Description
## Problem
The Loop Agent Type performs unsafe JSON parsing without proper sanitization or validation, creating security vulnerabilities and stability issues.
## Location
- File: `packages/AI/Agents/src/agent-types/loop-agent-type.ts`
- Lines: 83-104
## Issue Details
```typescript
if (typeof promptResult.result === 'string') {
response = JSON.parse(promptResult.result); // ⚠️ Unsafe parsing
} else {
response = promptResult.result as LoopAgentResponse; // ⚠️ Unsafe casting
}
```
## Vulnerabilities
1. **Raw JSON.parse()** without error boundaries beyond basic try/catch
2. **Type casting without runtime validation** - assumes structure is correct
3. **No size limits** on parsed JSON (potential DoS)
4. **No schema validation** against expected LoopAgentResponse structure
## Impact
- Malicious JSON injection attacks
- Application crashes from malformed responses
- Type confusion leading to runtime errors
- Potential denial of service from large payloads
## Suggested Fix
1. **Add JSON schema validation**
2. **Implement size limits** on parsed content
3. **Use safe parsing** with proper error handling
4. **Runtime type validation** instead of casting
## Code Example
```typescript
import Ajv from 'ajv';
const ajv = new Ajv();
const responseSchema = {
type: 'object',
properties: {
taskComplete: { type: 'boolean' },
message: { type: 'string', maxLength: 1000 },
nextStep: { type: 'object' },
// ... rest of schema
},
additionalProperties: false
};
const validateResponse = ajv.compile(responseSchema);
// Safe parsing with validation
function parseAgentResponse(result: string): LoopAgentResponse | null {
if (result.length > MAX_JSON_SIZE) {
throw new Error('Response too large');
}
try {
const parsed = JSON.parse(result);
if (\!validateResponse(parsed)) {
throw new Error(`Invalid response structure: ${ajv.errorsText(validateResponse.errors)}`);
}
return parsed as LoopAgentResponse;
} catch (error) {
LogError('JSON parsing failed', error);
return null;
}
}
```
## Priority
🚨 **High** - Security vulnerability with potential for exploitation
Contributor guide
Assessment
This issue has not been assessed yet.