Skip to content

fix: Round 6 slop audit — string type guards + HTTP port validation #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
b-macker merged 1 commit into from
Jun 13, 2026
Merged

fix: Round 6 slop audit — string type guards + HTTP port validation #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions src/packages/package_manager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ std::string PackageManager::getLatestRelease(const std::string& owner, const std

try {
auto j = nlohmann::json::parse(response);
if (j.contains("tag_name")) {
if (j.contains("tag_name") && j["tag_name"].is_string()) {
std::string tag = j["tag_name"].get<std::string>();
// Strip leading 'v' if present
if (!tag.empty() && tag[0] == 'v') tag = tag.substr(1);
Expand All @@ -185,7 +185,7 @@ std::vector<std::string> PackageManager::listTags(const std::string& owner, cons
try {
auto j = nlohmann::json::parse(response);
for (auto& tag : j) {
if (tag.contains("name")) {
if (tag.contains("name") && tag["name"].is_string()) {
tags.push_back(tag["name"].get<std::string>());
}
}
Expand Down Expand Up @@ -826,7 +826,7 @@ std::vector<PackageInfo> PackageManager::search(const std::string& query) const

if (!matches && pkg.contains("keywords")) {
for (auto& kw : pkg["keywords"]) {
std::string kw_str = kw.get<std::string>();
std::string kw_str = (kw.is_string() ? kw.get<std::string>() : std::string());
std::transform(kw_str.begin(), kw_str.end(), kw_str.begin(), ::tolower);
if (kw_str.find(q) != std::string::npos) {
matches = true;
Expand All @@ -843,7 +843,7 @@ std::vector<PackageInfo> PackageManager::search(const std::string& query) const
info.version = pkg.value("latest", "");
if (pkg.contains("keywords")) {
for (auto& kw : pkg["keywords"]) {
info.keywords.push_back(kw.get<std::string>());
if (kw.is_string()) info.keywords.push_back(kw.get<std::string>());
}
}
results.push_back(std::move(info));
Expand Down Expand Up @@ -1009,7 +1009,7 @@ bool PackageManager::applyPackageGovernance(const std::string& package_name) {
// Prefix rule IDs with package name
if (plugin.contains("rules") && plugin["rules"].is_array()) {
for (auto& rule : plugin["rules"]) {
if (rule.contains("id")) {
if (rule.contains("id") && rule["id"].is_string()) {
std::string id = rule["id"].get<std::string>();
if (id.find(package_name + ".") != 0) {
rule["id"] = package_name + "." + id;
Expand All @@ -1034,7 +1034,7 @@ bool PackageManager::applyPackageGovernance(const std::string& package_name) {
// Prefix rule IDs
if (plugin_entry.contains("rules") && plugin_entry["rules"].is_array()) {
for (auto& rule : plugin_entry["rules"]) {
if (rule.contains("id")) {
if (rule.contains("id") && rule["id"].is_string()) {
std::string id = rule["id"].get<std::string>();
if (id.find(package_name + ".") != 0) {
rule["id"] = package_name + "." + id;
Expand Down
20 changes: 10 additions & 10 deletions src/runtime/agent_provider.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,12 +136,12 @@ static HttpResult httpPostRaw(
// Extract error detail from non-2xx responses
if (result.status_code < 200 || result.status_code >= 300) {
std::string error_msg = "unknown error";
if (result.body.contains("error") && result.body["error"].contains("message")) {
if (result.body.contains("error") && result.body["error"].contains("message") && result.body["error"]["message"].is_string()) {
error_msg = result.body["error"]["message"].get<std::string>();
}
if (result.body.contains("error") && result.body["error"].contains("status")) {
if (result.body.contains("error") && result.body["error"].contains("status") && result.body["error"]["status"].is_string()) {
error_msg = result.body["error"]["status"].get<std::string>();
if (result.body["error"].contains("message"))
if (result.body["error"].contains("message") && result.body["error"]["message"].is_string())
error_msg += ": " + result.body["error"]["message"].get<std::string>();
}
if (error_msg.size() > 200) error_msg = error_msg.substr(0, 200) + "...";
Expand Down Expand Up @@ -298,7 +298,7 @@ static NormalizedResponse normalizeResponse(
auto& candidate = response["candidates"][0];
if (candidate.contains("content") && candidate["content"].contains("parts")) {
for (const auto& part : candidate["content"]["parts"]) {
if (part.contains("text")) {
if (part.contains("text") && part["text"].is_string()) {
// Skip Gemini/Gemma "thought" parts (internal reasoning tokens)
if (part.contains("thought") && part["thought"].is_boolean() && part["thought"].get<bool>())
continue;
Expand All @@ -307,7 +307,7 @@ static NormalizedResponse normalizeResponse(
} else if (part.contains("functionCall")) {
ToolCallInfo tc;
tc.id = "gemini_" + std::to_string(result.tool_calls.size());
if (part["functionCall"].contains("name"))
if (part["functionCall"].contains("name") && part["functionCall"]["name"].is_string())
tc.name = part["functionCall"]["name"].get<std::string>();
if (part["functionCall"].contains("args"))
tc.arguments = part["functionCall"]["args"].dump();
Expand All @@ -317,7 +317,7 @@ static NormalizedResponse normalizeResponse(
}
}
}
if (candidate.contains("finishReason"))
if (candidate.contains("finishReason") && candidate["finishReason"].is_string())
result.stop_reason = candidate["finishReason"].get<std::string>();
}
if (response.contains("usageMetadata")) {
Expand All @@ -333,14 +333,14 @@ static NormalizedResponse normalizeResponse(
} else {
if (response.contains("content") && response["content"].is_array()) {
for (const auto& block : response["content"]) {
if (block.contains("type") && block["type"] == "text" && block.contains("text")) {
if (block.contains("type") && block["type"] == "text" && block.contains("text") && block["text"].is_string()) {
if (!result.content.empty()) result.content += "\n";
result.content += block["text"].get<std::string>();
} else if (block.contains("type") && block["type"] == "tool_use") {
ToolCallInfo tc;
if (block.contains("id"))
if (block.contains("id") && block["id"].is_string())
tc.id = block["id"].get<std::string>();
if (block.contains("name"))
if (block.contains("name") && block["name"].is_string())
tc.name = block["name"].get<std::string>();
if (block.contains("input"))
tc.arguments = block["input"].dump();
Expand Down Expand Up @@ -652,7 +652,7 @@ ProviderResult callAgentWithTools(
bool is_gemma = config.model.find("gemma") != std::string::npos;
if (is_gemma) {
if (!contents.empty() && contents[0]["role"] == "user") {
std::string original = contents[0]["parts"][0]["text"].get<std::string>();
std::string original = contents[0]["parts"][0]["text"].is_string() ? contents[0]["parts"][0]["text"].get<std::string>() : "";
contents[0]["parts"][0]["text"] = config.system_prompt + "\n\n" + original;
request_body["contents"] = contents;
}
Expand Down
2 changes: 1 addition & 1 deletion src/runtime/agent_review.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ static bool loadCache(const std::string& path, AgentReviewResult& result,
f >> wrapper;

// F12: Verify HMAC integrity if present
if (wrapper.contains("hmac") && wrapper.contains("data")) {
if (wrapper.contains("hmac") && wrapper["hmac"].is_string() && wrapper.contains("data") && wrapper["data"].is_string()) {
std::string data_str = wrapper["data"].get<std::string>();
std::string stored_hmac = wrapper["hmac"].get<std::string>();
json j = json::parse(data_str);
Expand Down
14 changes: 7 additions & 7 deletions src/runtime/block_registry.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ std::string BlockRegistry::getBlockSource(const std::string& block_id) const {
source = block_json.value("code", "");

// If no inline code, check for code_file reference
if (source.empty() && block_json.contains("code_file")) {
if (source.empty() && block_json.contains("code_file") && block_json["code_file"].is_string()) {
std::string code_file = block_json["code_file"].get<std::string>();
// Resolve relative to the JSON file's directory
std::string dir = file_path.substr(0, file_path.find_last_of('/'));
Expand Down Expand Up @@ -220,11 +220,11 @@ void BlockRegistry::scanLanguageDirectory(const std::string& lang_dir, const std
metadata.is_active = block_json.value("is_active", true);

// Handle potentially null fields
metadata.category = block_json.contains("category") && !block_json["category"].is_null()
metadata.category = block_json.contains("category") && block_json["category"].is_string() && !block_json["category"].is_null()
? block_json["category"].get<std::string>() : "";
metadata.subcategory = block_json.contains("subcategory") && !block_json["subcategory"].is_null()
metadata.subcategory = block_json.contains("subcategory") && block_json["subcategory"].is_string() && !block_json["subcategory"].is_null()
? block_json["subcategory"].get<std::string>() : "";
metadata.code_hash = block_json.contains("code_hash") && !block_json["code_hash"].is_null()
metadata.code_hash = block_json.contains("code_hash") && block_json["code_hash"].is_string() && !block_json["code_hash"].is_null()
? block_json["code_hash"].get<std::string>() : "";

// AI-powered discovery fields (Phase 1.4)
Expand All @@ -236,17 +236,17 @@ void BlockRegistry::scanLanguageDirectory(const std::string& lang_dir, const std
// Vector fields with JSON array parsing
if (block_json.contains("keywords") && block_json["keywords"].is_array()) {
for (const auto& keyword : block_json["keywords"]) {
metadata.keywords.push_back(keyword.get<std::string>());
if (keyword.is_string()) metadata.keywords.push_back(keyword.get<std::string>());
}
}
if (block_json.contains("use_cases") && block_json["use_cases"].is_array()) {
for (const auto& use_case : block_json["use_cases"]) {
metadata.use_cases.push_back(use_case.get<std::string>());
if (use_case.is_string()) metadata.use_cases.push_back(use_case.get<std::string>());
}
}
if (block_json.contains("related_blocks") && block_json["related_blocks"].is_array()) {
for (const auto& related : block_json["related_blocks"]) {
metadata.related_blocks.push_back(related.get<std::string>());
if (related.is_string()) metadata.related_blocks.push_back(related.get<std::string>());
}
}

Expand Down
8 changes: 4 additions & 4 deletions src/runtime/block_search_index.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,15 +268,15 @@ class BlockSearchIndex::Impl {
if (block_json.contains("keywords") && block_json["keywords"].is_array()) {
for (const auto& keyword : block_json["keywords"]) {
if (!keywords_str.empty()) keywords_str += " ";
keywords_str += keyword.get<std::string>();
keywords_str += (keyword.is_string() ? keyword.get<std::string>() : std::string());
}
}

std::string use_cases_str;
if (block_json.contains("use_cases") && block_json["use_cases"].is_array()) {
for (const auto& use_case : block_json["use_cases"]) {
if (!use_cases_str.empty()) use_cases_str += " ";
use_cases_str += use_case.get<std::string>();
use_cases_str += (use_case.is_string() ? use_case.get<std::string>() : std::string());
}
}

Expand All @@ -300,14 +300,14 @@ class BlockSearchIndex::Impl {
// Index keywords
if (block_json.contains("keywords") && block_json["keywords"].is_array()) {
for (const auto& keyword : block_json["keywords"]) {
insertKeyword(block_id, keyword.get<std::string>());
if (keyword.is_string()) insertKeyword(block_id, keyword.get<std::string>());
}
}

// Index use cases
if (block_json.contains("use_cases") && block_json["use_cases"].is_array()) {
for (const auto& use_case : block_json["use_cases"]) {
insertUseCase(block_id, use_case.get<std::string>());
if (use_case.is_string()) insertUseCase(block_id, use_case.get<std::string>());
}
}

Expand Down
Loading
Loading