Skip to content

Harden terminal scrollback settings sync - #115

Merged
gedeagas merged 1 commit into
mainfrom
fix-terminal-scrollback-settings-sync
May 29, 2026
Merged

gedeagas merged 1 commit into
mainfrom
fix-terminal-scrollback-settings-sync

Conversation

@gedeagas

Copy link
Copy Markdown
Owner

Fixes review feedback from #114 by defensively parsing terminalScrollback in settings:sync before
updating mainSettings.

Validation:

  • npm run typecheck
  • npm test -- src/main/services/ptyDaemon/tests/protocol.test.ts src/main/services/ptyDaemon/tests/
    sessionHost.test.ts
  • git diff --check origin/main..HEAD

Copilot AI review requested due to automatic review settings May 29, 2026 03:15
@gedeagas
gedeagas merged commit 9bb5970 into main May 29, 2026
1 check failed

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the IPC handler for settings synchronization in src/main/ipc.ts to handle and parse the terminalScrollback setting more robustly when it is passed as a string or null. The reviewer identified potential robustness issues: first, using the in operator on values without verifying it is a non-null object could cause a TypeError and crash the process; second, using Number() directly on untrusted input can lead to unexpected numeric conversions (such as booleans or arrays being parsed as valid numbers). A code suggestion was provided to safely check the object type and strictly parse only numbers and non-empty strings.

Comment thread src/main/ipc.ts
Comment on lines +575 to +585
if ('terminalScrollback' in values) {
const rawScrollback = values.terminalScrollback as unknown
const parsedScrollback =
rawScrollback === null || (typeof rawScrollback === 'string' && rawScrollback.trim() === '')
? NaN
: Number(rawScrollback)
if (Number.isFinite(parsedScrollback)) {
values.terminalScrollback = clampTerminalScrollbackLines(parsedScrollback)
} else {
delete values.terminalScrollback
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Robustness & Defensive Parsing Issues

  1. TypeError / Crash Prevention: Since values is received over IPC, it is untrusted input and could potentially be null, undefined, or a primitive. Using the in operator on a non-object (e.g., 'terminalScrollback' in values) will throw a TypeError and crash the IPC handler/main process. We should guard this check by verifying that values is a non-null object.

  2. Strict Numeric Parsing: Using Number(rawScrollback) directly on non-numeric types can lead to unexpected results (e.g., Number(true) is 1, Number([]) is 0), which would then be clamped to 100 and saved as a valid scrollback setting. We should restrict parsing to actual numbers or non-empty strings.

    if (values && typeof values === 'object' && 'terminalScrollback' in values) {
      const rawScrollback = values.terminalScrollback as unknown
      let parsedScrollback = NaN
      if (typeof rawScrollback === 'number') {
        parsedScrollback = rawScrollback
      } else if (typeof rawScrollback === 'string' && rawScrollback.trim() !== '') {
        parsedScrollback = Number(rawScrollback)
      }
      if (Number.isFinite(parsedScrollback)) {
        values.terminalScrollback = clampTerminalScrollbackLines(parsedScrollback)
      } else {
        delete values.terminalScrollback
      }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants