MemberJunction / MemberJunction/MJ

Security: JSON Parsing Vulnerabilities in Loop Agent

Open
#1,186 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TSQL
Stars
29
Forks
6
Avg merge
2d 1h
Merged PRs (30d)
323

Description

## Problem
The Loop Agent Type performs unsafe JSON parsing without proper sanitization or validation, creating security vulnerabilities and stability issues.

## Location
- File: `packages/AI/Agents/src/agent-types/loop-agent-type.ts`
- Lines: 83-104

## Issue Details
```typescript
if (typeof promptResult.result === 'string') {
response = JSON.parse(promptResult.result); // ⚠️ Unsafe parsing
} else {
response = promptResult.result as LoopAgentResponse; // ⚠️ Unsafe casting
}
```

## Vulnerabilities
1. **Raw JSON.parse()** without error boundaries beyond basic try/catch
2. **Type casting without runtime validation** - assumes structure is correct
3. **No size limits** on parsed JSON (potential DoS)
4. **No schema validation** against expected LoopAgentResponse structure

## Impact
- Malicious JSON injection attacks
- Application crashes from malformed responses
- Type confusion leading to runtime errors
- Potential denial of service from large payloads

## Suggested Fix
1. **Add JSON schema validation**
2. **Implement size limits** on parsed content
3. **Use safe parsing** with proper error handling
4. **Runtime type validation** instead of casting

## Code Example
```typescript
import Ajv from 'ajv';

const ajv = new Ajv();
const responseSchema = {
type: 'object',
properties: {
taskComplete: { type: 'boolean' },
message: { type: 'string', maxLength: 1000 },
nextStep: { type: 'object' },
// ... rest of schema
},
additionalProperties: false
};

const validateResponse = ajv.compile(responseSchema);

// Safe parsing with validation
function parseAgentResponse(result: string): LoopAgentResponse | null {
if (result.length > MAX_JSON_SIZE) {
throw new Error('Response too large');
}

try {
const parsed = JSON.parse(result);
if (\!validateResponse(parsed)) {
throw new Error(`Invalid response structure: ${ajv.errorsText(validateResponse.errors)}`);
}
return parsed as LoopAgentResponse;
} catch (error) {
LogError('JSON parsing failed', error);
return null;
}
}
```

## Priority
🚨 **High** - Security vulnerability with potential for exploitation

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.