a2aproject / a2aproject/a2a-js

[Bug]: multiple content oneof arms are silently accepted instead of rejected

Đang mở
#643 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
TypeScript
Star
613
Fork
169
Merge trung bình
1 ngày 6 giờ
Pull request đã merge (30 ngày)
21

Mô tả

### What happened?

More than one member of a oneof being present is malformed input, and proto3 JSON treats
it as an error. `a2a-python` does:

```python
from a2a.types import Part
from google.protobuf.json_format import ParseDict

ParseDict({"text": "hello", "url": "https://example.com/x"}, Part())
# ParseError: Message type "lf.a2a.v1.Part" should not have multiple "content" oneof fields
```

This SDK accepts it and picks one:

```js
import { Part } from '@a2a-js/sdk';

Part.toJSON(Part.fromJSON({ text: 'hello', url: 'https://example.com/x' }));
// { text: 'hello' } url is gone, no error
```

### Why it matters

Which arm survives is decided by the order fields are assigned in the generated
`fromJSON` body, not by anything in the input. So a malformed message from a buggy peer
gets silently reinterpreted rather than refused, and the two SDKs can end up disagreeing
about what the sender meant. Silently is the part that bothers me: whoever sent it gets
no signal that half their Part was discarded.

### What I'd expect

`fromJSON` throws when more than one member of `content` is present, matching what
`a2a-python` and the proto3 JSON mapping do.

### How this was found

Round-tripping a shared corpus through this SDK and `a2a-python` and diffing the JSON.

Reproduced on `@a2a-js/sdk` 1.0.1 from npm and on `main` at `1c6eb32`, against
`a2a-python` at `cff6727`.

Generated code again, so let me know where you'd want the fix.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Hướng nghiên cứu

The issue is in the generated `fromJSON` method for the `Part` type. Look at the generated code for the `Part` message, likely in a file like `src/generated/a2a.ts`. Find where `fromJSON` assigns fields from the input object. The fix is to add validation that only one field from the `content` oneof is present before assignment, throwing an error if multiple are found. Test by creating a test case that passes an object with both `text` and `url` and expects an error, and verify the fix matches the Python SDK's behavior.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
javascript, typescript
Lĩnh vực
backend-api-design
Loại issue
Lỗi
Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức độ hoạt động
Sôi nổi
Độ rõ ràng
Đặc tả rõ ràng
Mức phù hợp với người mới
65/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.