Client Payload Validation and Automation Safety Enforcement Module#71
Client Payload Validation and Automation Safety Enforcement Module#71aniket866 wants to merge 3 commits intoAOSSIE-Org:mainfrom
Conversation
📝 WalkthroughWalkthroughInputHandler gained server-side input validation: new private constants limit text, deltas, scroll, zoom, and combo length; a clamp utility; and early-return checks that sanitize or reject out-of-range move, click, scroll, zoom, key, combo, and text inputs before action calls. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/server/InputHandler.ts (2)
63-96:⚠️ Potential issue | 🟡 MinorWrap
case 'scroll'body in a block to scope its declarations.Biome correctly flags
const safeScrollYandconst safeScrollX(lines 67, 71) as accessible from sibling switch clauses. While thebreakprevents actual fallthrough, wrapping the case body in braces is the standard fix and prevents future accidents if cases are reordered.This same pattern applies to other cases with
constdeclarations (zoom,key,combo,text), butscrollis the one flagged.Proposed fix
case 'scroll': + { const promises: Promise<void>[] = []; //Clamp scroll values ... if (promises.length) { await Promise.all(promises); } break; + }
147-178:⚠️ Potential issue | 🟠 MajorDeduplication happens before lowercasing, so case-variant duplicates (e.g.
"Shift"and"shift") both survive and press the same physical key twice.Lowercase first, then deduplicate to avoid double key-presses. Additionally:
- Same single-char case loss as the
keyhandler — line 174 typeslowerKeyinstead of originalk.- Dead code on lines 175-177 — the
elsebranch is unreachable because the guard on line 164 already filters out keys that aren't inKEY_MAPand aren't single-char.🐛 Proposed fix: lowercase-then-dedup, preserve original char, remove dead code
- // Remove duplicate keys - const uniqueKeys = [...new Set(msg.keys)]; + // Normalize to lowercase, then remove duplicates + const uniqueKeys = [...new Set(msg.keys.map(k => k.toLowerCase()))]; const nutKeys: (Key | string)[] = []; - for (const k of uniqueKeys) { - const lowerKey = k.toLowerCase(); - - if (!(lowerKey in KEY_MAP) && lowerKey.length !== 1) { - console.warn(`Blocked unknown key in combo: ${k}`); + for (const lowerKey of uniqueKeys) { + if (!(lowerKey in KEY_MAP) && lowerKey.length !== 1) { + console.warn(`Blocked unknown key in combo: ${lowerKey}`); continue; } const nutKey = KEY_MAP[lowerKey]; if (nutKey !== undefined) { nutKeys.push(nutKey); } else if (lowerKey.length === 1) { nutKeys.push(lowerKey); - } else { - console.warn(`Unknown key in combo: ${k}`); } }Note: lowering single-char combo keys is acceptable here since combos like
Ctrl+Aconventionally use lowercasea. If original case matters for the single-char path, you'd need to carry both the lowered and original values.
🤖 Fix all issues with AI agents
In `@src/server/InputHandler.ts`:
- Around line 129-143: The single-character fallback currently lowercases the
key and loses original case; change the logic in InputHandler.ts so KEY_MAP
lookup still uses lowerKey but when falling back to typing a raw single
character use the original msg.key (preserving case) instead of lowerKey — i.e.,
compute lowerKey for the KEY_MAP lookup and nutKey resolution, call
keyboard.type(nutKey) if defined, otherwise call keyboard.type(msg.key) when
msg.key.length === 1.
- Around line 29-31: The clamp method currently allows NaN through; update
InputHandler.clamp to be static and to guard non-finite values by returning 0
when value is NaN or not finite (Number.isFinite(value) check), otherwise
perform the existing Math.max/Math.min clamp; then change call-sites that use
this.clamp(…) to InputHandler.clamp(…) (affects calls before mouse.setPosition,
mouse.scrollDown, mouse.* zoom/move callers) so NaN no longer propagates into
mouse methods.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/server/InputHandler.ts (1)
174-175:⚠️ Potential issue | 🟠 MajorSame lowercase-typing bug as the
keyhandler — single-char combo keys lose case.Line 175 uses
lowerKeyinstead of the originalk, so an uppercase letter in a combo is silently downcased.Proposed fix
} else if (lowerKey.length === 1) { - nutKeys.push(lowerKey); + nutKeys.push(k); } else {
🤖 Fix all issues with AI agents
In `@src/server/InputHandler.ts`:
- Around line 157-158: The current dedup logic uses const uniqueKeys = [...new
Set(msg.keys)] which is case-sensitive and lets logical duplicates like "Shift"
and "shift" pass through; update the InputHandler handling to normalize keys
(e.g., toLowerCase or a canonical mapping) before deduplication so duplicates
compare in a case-insensitive form, then map back to the original/canonical Key
enum values (e.g., Key.LeftShift) used elsewhere; specifically, transform
msg.keys to a normalized array, run new Set(...) on that normalized form, and
then convert those normalized entries to the canonical Key tokens used by the
rest of the code (refer to uniqueKeys, msg.keys, and the Key enum /
Key.LeftShift resolution).
🧹 Nitpick comments (1)
src/server/InputHandler.ts (1)
64-97: Wrapscrollcase body in a block to fixconstleaking across switch clauses.Biome correctly flags
constdeclarations inside an unbracedcase— they are technically accessible from othercasebranches, which can cause confusing bugs if the switch is later extended.Proposed fix
- case 'scroll': - const promises: Promise<void>[] = []; + case 'scroll': { + const promises: Promise<void>[] = []; //Clamp scroll values ... if (promises.length) { await Promise.all(promises); } - break; + break; + }
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
@imxade Please check this out , a small fix but important Thankyou! |
1 participant
Addressed Issues: 30
In simple words this PR prevents any unkonwn input like infinite(9999999999999999999999999....) and other inputs by user ,
if not prevented it will crash the whole application because can't able to parse infinite, -infinite etc and all other input protection has bee packed into a allowed limit.
PR Summary
This PR strengthens the security and stability of
InputHandler.tsby introducing strict input validation and boundary enforcement.It prevents extreme client-sent values from crashing or freezing the host system.
All high-risk fields (dx, dy, delta, text, keys) are now properly clamped or validated.
These additions ensure predictable behavior while maintaining full backward compatibility.
What This Fix Prevents
Screenshots/Recordings:
Additional Notes:
Checklist
We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact.
Summary by CodeRabbit