blueprint/Codegen: escape blueprint-controlled strings in generated TypeScript

Open
#412 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript
Domain
security, tooling

Research direction

Start in packages/evolution/src/blueprint/Codegen.ts at generateTypeScript(), then review the listed string, property-name, and JSDoc emission sites. Trace the public entry through blueprint/index.ts and create or run the regression coverage using the crafted titles and validator values described in the issue. Done means generated output keeps every supplied value within its intended comment, literal, or property name and the regression test passes.

Written by the indexing model from the issue text.

Description

bug external-review

Summary

blueprint/Codegen.ts generateTypeScript() splices blueprint strings into generated
TypeScript without escaping, so a crafted blueprint can inject statements into the
output that run when a consumer builds or imports the generated file. Only reachable
when codegen runs over an untrusted blueprint (e.g. a third party's plutus.json);
self-authored blueprints are unaffected. generateTypeScript returns a string and
executes nothing itself.

Affected

packages/evolution/src/blueprint/Codegen.ts

  • L907 preamble.title in the header JSDoc (*/ breaks out)
  • L1092-1094 validator.title / hash / compiledCode as raw string literals
  • L248, L419, L606, L649 constructor tag in TSchema.Literal / TSchema.TaggedStruct
  • L286, L448, L525, L600, L645 field title used as an object property name, unquoted
  • L959-963, L1018-1023, L1059-1064, L1087-1090 title/description in JSDoc

entry: blueprint/index.ts exports Codegen.generateTypeScript (public via @evolution-sdk/evolution/blueprint).

Fix

  • string literals (title, hash, compiledCode, tag): emit with JSON.stringify, not "${value}".
  • property names (field titles): validate as identifier, else quote with JSON.stringify.
  • JSDoc (title, description, header): strip */, or drop untrusted strings from comments.

Regression test

  • given: preamble.title = x */\nglobalThis.__pwned = 1\n/*, validator title/hash/compiledCode with " and a newline
  • before: output contains the injected statement outside any comment/string
  • after: every value stays inside its intended comment or literal
    Must FAIL on main, PASS after the fix.

Reference

GHSA-79p9-vmph-w58f

Dominant language
TypeScript
Stars
22
Forks
30
Avg merge
13h
Merged PRs (30d)
14

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from IntersectMBO/evolution-sdk

All issues in IntersectMBO/evolution-sdk

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.