Harden terminal scrollback settings sync - #115
Conversation
There was a problem hiding this comment.
Code Review
This pull request updates the IPC handler for settings synchronization in src/main/ipc.ts to handle and parse the terminalScrollback setting more robustly when it is passed as a string or null. The reviewer identified potential robustness issues: first, using the in operator on values without verifying it is a non-null object could cause a TypeError and crash the process; second, using Number() directly on untrusted input can lead to unexpected numeric conversions (such as booleans or arrays being parsed as valid numbers). A code suggestion was provided to safely check the object type and strictly parse only numbers and non-empty strings.
| if ('terminalScrollback' in values) { | ||
| const rawScrollback = values.terminalScrollback as unknown | ||
| const parsedScrollback = | ||
| rawScrollback === null || (typeof rawScrollback === 'string' && rawScrollback.trim() === '') | ||
| ? NaN | ||
| : Number(rawScrollback) | ||
| if (Number.isFinite(parsedScrollback)) { | ||
| values.terminalScrollback = clampTerminalScrollbackLines(parsedScrollback) | ||
| } else { | ||
| delete values.terminalScrollback | ||
| } |
There was a problem hiding this comment.
Robustness & Defensive Parsing Issues
-
TypeError / Crash Prevention: Since
valuesis received over IPC, it is untrusted input and could potentially benull,undefined, or a primitive. Using theinoperator on a non-object (e.g.,'terminalScrollback' in values) will throw aTypeErrorand crash the IPC handler/main process. We should guard this check by verifying thatvaluesis a non-null object. -
Strict Numeric Parsing: Using
Number(rawScrollback)directly on non-numeric types can lead to unexpected results (e.g.,Number(true)is1,Number([])is0), which would then be clamped to100and saved as a valid scrollback setting. We should restrict parsing to actual numbers or non-empty strings.
if (values && typeof values === 'object' && 'terminalScrollback' in values) {
const rawScrollback = values.terminalScrollback as unknown
let parsedScrollback = NaN
if (typeof rawScrollback === 'number') {
parsedScrollback = rawScrollback
} else if (typeof rawScrollback === 'string' && rawScrollback.trim() !== '') {
parsedScrollback = Number(rawScrollback)
}
if (Number.isFinite(parsedScrollback)) {
values.terminalScrollback = clampTerminalScrollbackLines(parsedScrollback)
} else {
delete values.terminalScrollback
}
Fixes review feedback from #114 by defensively parsing terminalScrollback in settings:sync before
updating mainSettings.
Validation:
sessionHost.test.ts