a2aproject / a2aproject/a2a-js
[Bug]: multiple content oneof arms are silently accepted instead of rejected
- Langage dominant
- TypeScript
- Étoiles
- 613
- Forks
- 169
- Merge moyen
- 1 j 6 h
- PR mergées (30 j)
- 21
Description
### What happened?
More than one member of a oneof being present is malformed input, and proto3 JSON treats
it as an error. `a2a-python` does:
```python
from a2a.types import Part
from google.protobuf.json_format import ParseDict
ParseDict({"text": "hello", "url": "https://example.com/x"}, Part())
# ParseError: Message type "lf.a2a.v1.Part" should not have multiple "content" oneof fields
```
This SDK accepts it and picks one:
```js
import { Part } from '@a2a-js/sdk';
Part.toJSON(Part.fromJSON({ text: 'hello', url: 'https://example.com/x' }));
// { text: 'hello' } url is gone, no error
```
### Why it matters
Which arm survives is decided by the order fields are assigned in the generated
`fromJSON` body, not by anything in the input. So a malformed message from a buggy peer
gets silently reinterpreted rather than refused, and the two SDKs can end up disagreeing
about what the sender meant. Silently is the part that bothers me: whoever sent it gets
no signal that half their Part was discarded.
### What I'd expect
`fromJSON` throws when more than one member of `content` is present, matching what
`a2a-python` and the proto3 JSON mapping do.
### How this was found
Round-tripping a shared corpus through this SDK and `a2a-python` and diffing the JSON.
Reproduced on `@a2a-js/sdk` 1.0.1 from npm and on `main` at `1c6eb32`, against
`a2a-python` at `cff6727`.
Generated code again, so let me know where you'd want the fix.
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.