compiler: detect suspicious JSONpath strings
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 21
- Forks
- 23
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 17
Description
Follow up to OpenFn/adaptors#781
JSON path strings in old adaptor versions to provide an attack vector to run arbritary code. I do not know if this allows breaking out of the sandbox.
https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884
The compiler could detect suspicious json path strings and throw an error, refusing the execute the job.
If we detect a json path string like $.a.b.c with anything weird in it, like parenthesis, the compiler could throw.
Workflows which do use jsonpath strings should really only be using super simple expressions, and I'd be reasonably happy to throw if anything looks amiss in those strings. I think the pattern is fairly strong.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the compiler entry point that processes JSON path strings, then review the security report and follow-up OpenFn/adaptors#781 for context. Done should include rejecting suspicious expressions while preserving the simple JSON path usage described in the issue, with the exact detection boundary agreed before implementation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- compilers, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100