From ad39293c937cd783bd2cb4e299d403f47c67f5d1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 25 Aug 2026 14:13:27 +0000
Subject: [PATCH] docs(core): replace the dangling SECURITY_FIX_SUMMARY @see
 with its rationale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`SimpleExpressionEvaluator`'s doc block pointed at
https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md.
That file was deleted in ea72f1886 — a 20-file bulk removal of the root-level
PR #300 / v0.4.0 summaries, 6742 deletions and zero insertions, so the content
was dropped outright rather than migrated. The link has 404'd since.

Reading `git show ea72f1886^:SECURITY_FIX_SUMMARY.md` shows the doc block
already repeats most of what it carried (the operator list, the LIMITATIONS
list verbatim). One thing it carried is NOT in the doc block and is
load-bearing: the parser exists because CodeQL flagged the previous
`new Function(...contextKeys, "'use strict'; return (…)")` as "Unsafe code
constructed from library input". That makes the ban on dynamic code execution
a remediation constraint a future maintainer must not trade away for
expressiveness or speed, not a style preference. That sentence is now inline,
and the provenance points at the immutable git object instead of a `main` blob
path that no longer resolves.

Comment-only: `SimpleExpressionEvaluator` is not exported, so nothing changes
in the emitted `.d.ts`, and no behaviour, type or API surface moves.
---
 .../issue-6275-validation-engine-dangling-see.md  |  7 +++++++
 .../validators/object-validation-engine.ts        | 15 +++++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/issue-6275-validation-engine-dangling-see.md

diff --git a/.changeset/issue-6275-validation-engine-dangling-see.md b/.changeset/issue-6275-validation-engine-dangling-see.md
new file mode 100644
index 0000000000..47ffe32e45
--- /dev/null
+++ b/.changeset/issue-6275-validation-engine-dangling-see.md
@@ -0,0 +1,7 @@
+---
+---
+
+Comment-only change in `@object-ui/core`: the `SimpleExpressionEvaluator` doc block
+no longer points at the deleted `SECURITY_FIX_SUMMARY.md`, and states the security
+rationale inline instead. Releases nothing — the class is not exported, so the doc
+block reaches no `.d.ts`, and no behaviour, type or API surface changes.
diff --git a/packages/core/src/validation/validators/object-validation-engine.ts b/packages/core/src/validation/validators/object-validation-engine.ts
index 7dedca662f..09a944f47f 100644
--- a/packages/core/src/validation/validators/object-validation-engine.ts
+++ b/packages/core/src/validation/validators/object-validation-engine.ts
@@ -199,7 +199,15 @@ export interface ValidationExpressionEvaluator {
  * Simple expression evaluator using a simple parser (no dynamic code execution)
  *
  * SECURITY: This implementation parses expressions into an AST and evaluates them
- * without using eval() or new Function(). It supports:
+ * without using eval() or new Function(). That is a remediation, not a style
+ * preference: an earlier revision compiled the predicate with
+ * `new Function(...contextKeys, "'use strict'; return (" + expression + ")")`,
+ * and CodeQL flagged it as "Unsafe code constructed from library input" —
+ * expressions reach this class from validation metadata, so that shape is a
+ * code-injection vector in any consumer that renders metadata it does not
+ * control. Never reintroduce eval(), new Function() or any other dynamic-code
+ * path here to buy expressiveness or speed; extend the parser, or inject a
+ * richer evaluator through the constructor (see NOT CEL below). Supports:
  * - Comparison operators: ==, !=, >, <, >=, <=
  * - Logical operators: &&, ||, !
  * - Property access: record.field, record['field']
@@ -218,7 +226,10 @@ export interface ValidationExpressionEvaluator {
  * pre-check agree with the server on richer predicates, pass a CEL-backed
  * `ValidationExpressionEvaluator` to the constructor.
  *
- * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
+ * The write-up this block used to link to (`SECURITY_FIX_SUMMARY.md`) was
+ * deleted with no successor; its load-bearing reasoning is inline above, and
+ * the original text remains readable at
+ * `git show ea72f1886^:SECURITY_FIX_SUMMARY.md`.
  */
 class SimpleExpressionEvaluator implements ValidationExpressionEvaluator {
   evaluate(expression: string, context: Record<string, any>): any {