happybara-io / WorkflowBuddy

The missing pieces of Slack Workflow Builder.
GNU Affero General Public License v3.0
27 stars 4 forks source link

Make our JSON parser more forgiving for input #38

Open I-Dont-Remember opened 1 year ago

I-Dont-Remember commented 1 year ago

Inspired by the same quote as this JSON Sanitizer:

be conservative in what you do, be liberal in what you accept from others


Workflow Buddy accepts a bunch of JSON from plain-text forms that are easy to muck up, especially once you take into account Slack inserts variables at runtime that can have ANY garbage, anything at all.

What is the flow of data?

Why can this be a problem? JSON parsers DO NOT like random unescaped " characters throwing off their parsing.

I-Dont-Remember commented 1 year ago

39 was a start - handling the unescaped " double quotes from variables. Unescaped ones manually added should get caught during Step edit because of the JSON validation we run.

Unless some other super common substring crops up as having issues, extending this seems like a Nice-to-Have rather than a Need-to-Do.