Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

trust-record-verify: reject non-object inputs in parentRecordHash, verifyDelegationLink, and bundleDigest

Abierto
  • ¿Algo no está bien?
#616 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@drk-ram ya está trabajando en esto.

Desde el 23/10/2026.

  • #622 de @drk-ram — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
javascript, python, typescript
Área
backend, security

Línea de trabajo

Read trust-record-verify/src/delegation.ts and trust-record-verify/src/revocation.ts, then compare the Python entry-point checks in src/agentrust_trace/delegation.py and src/agentrust_trace/revocation.py. Check the TypeScript tests for these functions and the revocation bundle validation order. Done means non-object inputs produce the specified errors while checkRevocationBundle still reports bundle_malformed; an open pull request already addresses this issue.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs-review:MEDIUM

What is wrong

At main (a8e3559), @agentrust-io/trust-record-verify (trust-record-verify/src/delegation.ts and trust-record-verify/src/revocation.ts) accepts non-object inputs in parentRecordHash, verifyDelegationLink, and bundleDigest:

  1. parentRecordHash(record) and verifyDelegationLink(child, parent) accept non-object record / parent values:

    • In trust-record-verify/src/delegation.ts:38-48, parentRecordHash(record, algorithm) calls canonicalize(record) without checking isPlainObject(record). Because numbers (123), booleans (true), strings ("abc"), arrays ([1, 2]), and null have valid RFC 8785 forms, await parentRecordHash(123) returns "sha256:a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3" instead of rejecting with record_not_object.
    • In verifyDelegationLink(child, parent, options) (trust-record-verify/src/delegation.ts:81-127), isPlainObject(child) is checked at line 95, but isPlainObject(parent) is never checked. Passing parent = 123 (or null, true, "str", [1, 2]) with a matching child.delegation.parent_record_hash resolves with a DelegationLink for a non-object parent (and when the hash differs, rejects with delegation_parent_mismatch instead of record_not_object).
    • By contrast, Python agentrust_trace.delegation.parent_record_hash and verify_delegation_link reject any non-dict record or parent at entry.

  2. bundleDigest(bundle) accepts non-object bundle values:

    • In trust-record-verify/src/revocation.ts:75-77, bundleDigest(bundle) calls canonicalize(bundle) without checking isPlainObject(bundle). Passing 123, null, true, "str", or [1, 2] returns a sha256:... digest instead of throwing TraceVerificationError (invalid_argument), whereas Python agentrust_trace.revocation.bundle_digest (src/agentrust_trace/revocation.py:206-207) raises ValueError("bundle must be a JSON object...").

Reproduction on a8e3559:

import { parentRecordHash, verifyDelegationLink, bundleDigest } from "./trust-record-verify/dist/index.js";

const h = await parentRecordHash(123);
// 1. Resolves instead of rejecting with record_not_object:
await verifyDelegationLink({ delegation: { parent_record_hash: h, credential_id: "c1" } }, 123);

// 2. Resolves instead of rejecting with invalid_argument:
await bundleDigest(123);

Spec section or file

  • trust-record-verify/src/delegation.ts (parentRecordHash, verifyDelegationLink)
  • trust-record-verify/src/revocation.ts (bundleDigest)
  • spec/trace-v0.2.md sections 3.1.3 and 3.2.3

Expected behavior

  1. parentRecordHash(record, algorithm) and verifyDelegationLink(child, parent, options) require isPlainObject(record) and isPlainObject(parent), failing with record_not_object ("a Trust Record is a JSON object") before computing or comparing digests.
  2. bundleDigest(bundle) requires isPlainObject(bundle), failing with invalid_argument ("bundle must be a JSON object") on non-object inputs, while checkRevocationBundle continues to report non-object bundles as bundle_malformed at step 1 before calling bundleDigest.

Impact

verifyDelegationLink in @agentrust-io/trust-record-verify accepts non-object parent values as valid parent Trust Records when their RFC 8785 digest matches child.delegation.parent_record_hash, and parentRecordHash / bundleDigest diverge from Python agentrust_trace.

Lenguaje dominante
Python
Estrellas
37
Forks
33
Merge medio
1 d 4 h
PR fusionados (30 d)
111

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de agentrust-io/trace-spec

Todos los issues de agentrust-io/trace-spec

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.