From 4eb378bca1870bad7ce128b1b5e1e9506270c557 Mon Sep 17 00:00:00 2001 From: Norbert Biczo Date: Tue, 21 Jul 2026 14:20:01 +0200 Subject: [PATCH] fix(merge-allof-schema-properties): avoid file content disclosure Fixed a security vulnerability related to CWE-209 (Generation of Error Message Containing Sensitive Information) in the merge-allof-schema-properties utility function. Signed-off-by: Norbert Biczo --- .../src/utils/merge-allof-schema-properties.js | 6 ++++++ .../merge-allof-schema-properties.test.js | 18 ++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/packages/ruleset/src/utils/merge-allof-schema-properties.js b/packages/ruleset/src/utils/merge-allof-schema-properties.js index 063b1d883..dd18b7b12 100644 --- a/packages/ruleset/src/utils/merge-allof-schema-properties.js +++ b/packages/ruleset/src/utils/merge-allof-schema-properties.js @@ -8,6 +8,12 @@ const { isObject, mergeWith } = require('lodash'); // Takes a schema, and if an allOf field is provided, // merges all allOf schema properties to create one schema function mergeAllOfSchemaProperties(schema) { + // Type guard: reject non-object input before applying 'in' operator + // This prevents TypeError when schema is a string (e.g., resolved file contents) + if (typeof schema !== 'object' || schema === null) { + return schema; + } + // Bail out immediately if 'schema' has no "allOf" field. if (!('allOf' in schema)) { return schema; diff --git a/packages/ruleset/test/utils/merge-allof-schema-properties.test.js b/packages/ruleset/test/utils/merge-allof-schema-properties.test.js index 1e0545b6a..f8443c671 100644 --- a/packages/ruleset/test/utils/merge-allof-schema-properties.test.js +++ b/packages/ruleset/test/utils/merge-allof-schema-properties.test.js @@ -291,4 +291,22 @@ describe('Utility function: mergeAllOfSchemaProperties()', () => { expect(mergeAllOfSchemaProperties(schema)).toStrictEqual(expectedResult); }); + + it('should safely handle non-object input (security: CWE-209)', async () => { + // Test with string input (simulates resolved file contents) + const stringInput = 'random_string_input'; + expect(mergeAllOfSchemaProperties(stringInput)).toBe(stringInput); + + // Test with null input + expect(mergeAllOfSchemaProperties(null)).toBe(null); + + // Test with undefined input + expect(mergeAllOfSchemaProperties(undefined)).toBe(undefined); + + // Test with number input + expect(mergeAllOfSchemaProperties(42)).toBe(42); + + // Test with boolean input + expect(mergeAllOfSchemaProperties(true)).toBe(true); + }); });