a2aproject / a2aproject/a2a-js

[Bug]: multiple content oneof arms are silently accepted instead of rejected

未关闭
#643 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
TypeScript
星标
613
派生
169
平均合并
1 天 6 小时
30 天内合并 PR
21

描述

### What happened?

More than one member of a oneof being present is malformed input, and proto3 JSON treats
it as an error. `a2a-python` does:

```python
from a2a.types import Part
from google.protobuf.json_format import ParseDict

ParseDict({"text": "hello", "url": "https://example.com/x"}, Part())
# ParseError: Message type "lf.a2a.v1.Part" should not have multiple "content" oneof fields
```

This SDK accepts it and picks one:

```js
import { Part } from '@a2a-js/sdk';

Part.toJSON(Part.fromJSON({ text: 'hello', url: 'https://example.com/x' }));
// { text: 'hello' } url is gone, no error
```

### Why it matters

Which arm survives is decided by the order fields are assigned in the generated
`fromJSON` body, not by anything in the input. So a malformed message from a buggy peer
gets silently reinterpreted rather than refused, and the two SDKs can end up disagreeing
about what the sender meant. Silently is the part that bothers me: whoever sent it gets
no signal that half their Part was discarded.

### What I'd expect

`fromJSON` throws when more than one member of `content` is present, matching what
`a2a-python` and the proto3 JSON mapping do.

### How this was found

Round-tripping a shared corpus through this SDK and `a2a-python` and diffing the JSON.

Reproduced on `@a2a-js/sdk` 1.0.1 from npm and on `main` at `1c6eb32`, against
`a2a-python` at `cff6727`.

Generated code again, so let me know where you'd want the fix.

贡献指南

打开贡献指南

调研方向

The issue is in the generated `fromJSON` method for the `Part` type. Look at the generated code for the `Part` message, likely in a file like `src/generated/a2a.ts`. Find where `fromJSON` assigns fields from the input object. The fix is to add validation that only one field from the `content` oneof is present before assignment, throwing an error if multiple are found. Test by creating a test case that passes an object with both `text` and `url` and expects an error, and verify the fix matches the Python SDK's behavior.

由索引模型根据 Issue 内容生成。

评估

技术栈
javascript, typescript
领域
backend-api-design
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
活跃
描述清晰度
描述清楚
新手友好度
65/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。