fix(oracle-fusion): close validation edge cases

Author: Bill Leoutsakos

apps/sim/lib/internal/oracle-fusion/identifiers.test.ts

@@ -70,4 +70,12 @@ describe('normalizeOracleFusionDecimalIdentifier', () => {
       normalizeOracleFusionDecimalIdentifier('1', { maxDigits: 129, maxSourceLength: 128 })
     ).toThrow('limits are invalid')
   })
+
+  it('checks the digit limit after removing an exact fractional suffix', () => {
+    expect(
+      normalizeOracleFusionDecimalIdentifier('123456000.000', {
+        maxDigits: 8,
+      })
+    ).toBeUndefined()
+  })
 })

apps/sim/lib/internal/oracle-fusion/identifiers.ts

@@ -103,5 +103,7 @@ export function normalizeOracleFusionDecimalIdentifier(
   if (fractionalDigits > significantCoefficient.length) return undefined
   const suffix = significantCoefficient.slice(significantCoefficient.length - fractionalDigits)
   if (!/^0*$/.test(suffix)) return undefined
-  return significantCoefficient.slice(0, significantCoefficient.length - fractionalDigits) || '0'
+  const normalized =
+    significantCoefficient.slice(0, significantCoefficient.length - fractionalDigits) || '0'
+  return normalized.length <= options.maxDigits ? normalized : undefined
 }

apps/sim/lib/internal/oracle-fusion/protocol.test.ts

@@ -170,6 +170,16 @@ describe('Oracle self links', () => {
     )
   })
 
+  it('rejects a self-link href containing malformed Unicode before URL parsing', () => {
+    expect(() =>
+      extractOracleFusionOpaqueKey(
+        resource(`${ORIGIN}${COLLECTION}/bad\ud800key`),
+        ORIGIN,
+        COLLECTION_ADDRESS
+      )
+    ).toThrow('Oracle self link is malformed')
+  })
+
   it.each([
     [`${ORIGIN}/other/abc`, 'collection path'],
     [`${ORIGIN}${COLLECTION}/a/b`, 'one opaque key'],

apps/sim/lib/internal/oracle-fusion/protocol.ts

@@ -7,6 +7,20 @@ import {
 const OPAQUE_KEY_MAX_LENGTH = 2048
 const UNSAFE_OPAQUE_KEY = /[\\/?#\u0000-\u001f\u007f]/
 
+function hasWellFormedUtf16(value: string): boolean {
+  for (let index = 0; index < value.length; index++) {
+    const codeUnit = value.charCodeAt(index)
+    if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+      const next = value.charCodeAt(index + 1)
+      if (!(next >= 0xdc00 && next <= 0xdfff)) return false
+      index++
+    } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+      return false
+    }
+  }
+  return true
+}
+
 export interface OracleFusionCollection<T> {
   items: T[]
   count: number
@@ -111,7 +125,9 @@ function getOnlySelfLink(value: unknown): URL {
     throw new Error('Oracle response must include exactly one self link')
   }
   const href = (selfLinks[0] as Record<string, unknown>).href
-  if (typeof href !== 'string') throw new Error('Oracle self link is malformed')
+  if (typeof href !== 'string' || !hasWellFormedUtf16(href)) {
+    throw new Error('Oracle self link is malformed')
+  }
   try {
     return new URL(href)
   } catch {
@@ -157,17 +173,8 @@ function validateOpaqueKey(key: string): string {
   ) {
     throw new Error('Oracle resource key is not a safe opaque path segment')
   }
-  for (let index = 0; index < key.length; index++) {
-    const codeUnit = key.charCodeAt(index)
-    if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
-      const next = key.charCodeAt(index + 1)
-      if (!(next >= 0xdc00 && next <= 0xdfff)) {
-        throw new Error('Oracle resource key contains malformed Unicode')
-      }
-      index++
-    } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
-      throw new Error('Oracle resource key contains malformed Unicode')
-    }
+  if (!hasWellFormedUtf16(key)) {
+    throw new Error('Oracle resource key contains malformed Unicode')
   }
   return key
 }

apps/sim/lib/internal/oracle-fusion/request-body.test.ts

@@ -64,6 +64,20 @@ describe('serializeOracleFusionJsonBody', () => {
     expect(() => serializeOracleFusionJsonBody(customArray)).toThrow('plain JSON data')
   })
 
+  it('rejects inherited custom serialization before JSON.stringify can invoke it', () => {
+    const previous = Object.getOwnPropertyDescriptor(Array.prototype, 'toJSON')
+    Object.defineProperty(Array.prototype, 'toJSON', {
+      configurable: true,
+      value: () => ({ replaced: true }),
+    })
+    try {
+      expect(() => serializeOracleFusionJsonBody([1])).toThrow('plain JSON data')
+    } finally {
+      if (previous) Object.defineProperty(Array.prototype, 'toJSON', previous)
+      else Reflect.deleteProperty(Array.prototype, 'toJSON')
+    }
+  })
+
   it('rejects cycles, excessive nesting, and excessive complexity', () => {
     const cycle: unknown[] = []
     cycle.push(cycle)

apps/sim/lib/internal/oracle-fusion/request-body.ts

@@ -134,11 +134,18 @@ function isRecordLike(value: unknown): value is Record<string, unknown> {
 }
 
 function assertContainerIsPlain(value: object): void {
+  for (
+    let candidate: object | null = value;
+    candidate;
+    candidate = Object.getPrototypeOf(candidate)
+  ) {
+    if (Object.hasOwn(candidate, 'toJSON')) throwNonPlainJsonError()
+  }
   for (const key of Reflect.ownKeys(value)) {
     if (typeof key === 'symbol') throwNonPlainJsonError()
     if (key === 'length' && Array.isArray(value)) continue
     const descriptor = Object.getOwnPropertyDescriptor(value, key)
-    if (descriptor?.get || descriptor?.set || key === 'toJSON') throwNonPlainJsonError()
+    if (descriptor?.get || descriptor?.set) throwNonPlainJsonError()
     if (Array.isArray(value)) {
       const index = Number(key)
       if (