@zudojs/rpc 1.3.0 → 1.4.0

package/dist/rpc/validation/rpcUnsafeKey.helper.js

@@ -0,0 +1,60 @@
+/**
+ * Detection of prototype-polluting keys in decoded, untrusted data.
+ */
+import { SCHEMA_FORBIDDEN_KEYS } from "@zudojs/constants";
+function isTraversable(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    if (Array.isArray(value)) {
+        return true;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+/**
+ * Returns the first `__proto__`, `constructor` or `prototype` key found
+ * anywhere in `value`, or `undefined` when there is none.
+ *
+ * `JSON.parse` keeps such a key as an ordinary own property, so it reaches
+ * handlers intact; the moment one is copied with `Object.assign`, a
+ * `for…in` merge or a bracket assignment, it replaces the target's
+ * prototype. Transports refuse a frame that carries one rather than
+ * silently dropping it.
+ *
+ * Walks plain objects and arrays only, iteratively (no recursion limit)
+ * and cycle-safe, so it is safe on any decoded or in-process value.
+ */
+export function findUnsafeKey(value) {
+    if (!isTraversable(value)) {
+        return undefined;
+    }
+    const seen = new WeakSet();
+    const pending = [value];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        if (seen.has(node)) {
+            continue;
+        }
+        seen.add(node);
+        if (Array.isArray(node)) {
+            for (const child of node) {
+                if (isTraversable(child)) {
+                    pending.push(child);
+                }
+            }
+            continue;
+        }
+        for (const key of Object.keys(node)) {
+            if (SCHEMA_FORBIDDEN_KEYS.has(key)) {
+                return key;
+            }
+            const child = node[key];
+            if (isTraversable(child)) {
+                pending.push(child);
+            }
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=rpcUnsafeKey.helper.js.map

package/dist/rpc/validation/rpcValidation.core.d.ts

@@ -33,6 +33,13 @@ export interface RPCRequestLimits {
      * Defaults to `true`.
      */
     readonly enforceProcedureNamePattern?: boolean;
+    /**
+     * Accept `__proto__`, `constructor` and `prototype` as keys inside
+     * `payload` and `metadata`. Defaults to `false`: a frame carrying one is
+     * refused, because a handler that merges its input into another object
+     * would have that object's prototype replaced.
+     */
+    readonly allowUnsafeKeys?: boolean;
 }
 /**
  * Validates a procedure name.
@@ -53,10 +60,12 @@ export declare function measurePayloadBytes(payload: unknown): number | undefine
  *
  * Every caller-controlled part of the frame is bounded: the id by
  * length, the procedure name by length and pattern, and `payload` plus
- * `metadata` by their combined encoded size.
+ * `metadata` by their combined encoded size. Neither may carry a
+ * prototype-polluting key unless `limits.allowUnsafeKeys` is set.
  *
  * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
- * over-long, or payload and metadata together exceed the configured limit.
+ * over-long, payload and metadata together exceed the configured limit, or
+ * either carries a `__proto__`, `constructor` or `prototype` key.
  */
 export declare function assertValidRequest(request: unknown, limits?: RPCRequestLimits): asserts request is RPCRequest;
 /**

package/dist/rpc/validation/rpcValidation.core.js

@@ -6,6 +6,7 @@
  * Requests arrive from an untrusted peer over a transport, so these are
  * the first checks the server runs, not the last.
  */
+import { findUnsafeKey } from "@zudojs/security";
 import { RPCInternalError, RPCInvalidRequestError, RPCValidationError, } from "../errors/rpc.errors.js";
 import { MAX_PROCEDURE_NAME_LENGTH, MAX_RPC_PAYLOAD_SIZE, MAX_RPC_REQUEST_ID_LENGTH, PROCEDURE_NAME_PATTERN, } from "../constants/rpcConstants.core.js";
 /**
@@ -51,10 +52,12 @@ export function measurePayloadBytes(payload) {
  *
  * Every caller-controlled part of the frame is bounded: the id by
  * length, the procedure name by length and pattern, and `payload` plus
- * `metadata` by their combined encoded size.
+ * `metadata` by their combined encoded size. Neither may carry a
+ * prototype-polluting key unless `limits.allowUnsafeKeys` is set.
  *
  * @throws {RPCInvalidRequestError} when the frame is malformed, the id is
- * over-long, or payload and metadata together exceed the configured limit.
+ * over-long, payload and metadata together exceed the configured limit, or
+ * either carries a `__proto__`, `constructor` or `prototype` key.
  */
 export function assertValidRequest(request, limits = {}) {
     if (typeof request !== "object" || request === null) {
@@ -94,6 +97,12 @@ export function assertValidRequest(request, limits = {}) {
             throw new RPCInvalidRequestError(`Request payload of ${size} bytes exceeds the ${maxBytes} byte limit.`, candidate.procedure);
         }
     }
+    if (limits.allowUnsafeKeys !== true) {
+        const unsafe = findUnsafeKey(candidate.payload) ?? findUnsafeKey(candidate.metadata);
+        if (unsafe !== undefined) {
+            throw new RPCInvalidRequestError(`Request contains the forbidden key "${unsafe}".`, candidate.procedure);
+        }
+    }
 }
 /**
  * Converts schema issues into metadata safe to return to a caller.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/rpc",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Remote procedure call infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -27,14 +27,16 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/errors": "1.2.0",
-    "@zudojs/constants": "1.1.1",
-    "@zudojs/types": "1.1.1",
-    "@zudojs/schema": "1.1.1"
+    "@zudojs/constants": "1.1.2",
+    "@zudojs/errors": "1.3.0",
+    "@zudojs/schema": "1.2.0",
+    "@zudojs/security": "1.3.0",
+    "@zudojs/serialization": "1.2.0",
+    "@zudojs/types": "1.2.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   },
   "publishConfig": {
     "access": "public"
@@ -45,7 +47,7 @@
     "remote",
     "procedure"
   ],
-  "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "homepage": "https://zudojs.oyinlola.site/docs/packages-rpc",
   "bugs": {
     "url": "https://github.com/oyinlola-tech/zudo/issues"
   },