Skip to content

docs(core): replace the dangling SECURITY_FIX_SUMMARY @see with its rationale#6339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-support-ai merged 1 commit into from
Aug 25, 2026
+20 −2
Merged

docs(core): replace the dangling SECURITY_FIX_SUMMARY @see with its rationale #6339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .changeset/issue-6275-validation-engine-dangling-see.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
---
---

Comment-only change in `@object-ui/core`: the `SimpleExpressionEvaluator` doc block
no longer points at the deleted `SECURITY_FIX_SUMMARY.md`, and states the security
rationale inline instead. Releases nothing — the class is not exported, so the doc
block reaches no `.d.ts`, and no behaviour, type or API surface changes.
15 changes: 13 additions & 2 deletions packages/core/src/validation/validators/object-validation-engine.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -199,7 +199,15 @@ export interface ValidationExpressionEvaluator {
* Simple expression evaluator using a simple parser (no dynamic code execution)
*
* SECURITY: This implementation parses expressions into an AST and evaluates them
* without using eval() or new Function(). It supports:
* without using eval() or new Function(). That is a remediation, not a style
* preference: an earlier revision compiled the predicate with
* `new Function(...contextKeys, "'use strict'; return (" + expression + ")")`,
* and CodeQL flagged it as "Unsafe code constructed from library input" —
* expressions reach this class from validation metadata, so that shape is a
* code-injection vector in any consumer that renders metadata it does not
* control. Never reintroduce eval(), new Function() or any other dynamic-code
* path here to buy expressiveness or speed; extend the parser, or inject a
* richer evaluator through the constructor (see NOT CEL below). Supports:
* - Comparison operators: ==, !=, >, <, >=, <=
* - Logical operators: &&, ||, !
* - Property access: record.field, record['field']
Expand All@@ -218,7 +226,10 @@ export interface ValidationExpressionEvaluator {
* pre-check agree with the server on richer predicates, pass a CEL-backed
* `ValidationExpressionEvaluator` to the constructor.
*
* @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
* The write-up this block used to link to (`SECURITY_FIX_SUMMARY.md`) was
* deleted with no successor; its load-bearing reasoning is inline above, and
* the original text remains readable at
* `git show ea72f1886^:SECURITY_FIX_SUMMARY.md`.
*/
class SimpleExpressionEvaluator implements ValidationExpressionEvaluator {
evaluate(expression: string, context: Record<string, any>): any {
Expand Down
Loading