Repository navigation

fix: bound JSON Schema pattern evaluation in a worker process - #6957

Merged

ja8zyjits merged 36 commits into

mainfrom

fix/bound-schema-pattern-evaluation

Oct 1, 2026

Commits on Oct 1, 2026
- test: establish sandbox start-method support for validation workers
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  cecbaa6
- refactor(security): extract killable sandbox pool from jq runner
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  615e03f
- fix(security): read the sandbox budget before taking a permit
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  38f38a5
- feat(security): run regex-bearing schema validation in a killable sandbox
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  46b6776
- test(security): assert the sandbox bounds the validation, not the clock
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  533d96b
- fix(security): refuse an unknown validator class and test the escape for real
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  74eeab4
- fix(security): bound tool input and output schema validation
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  a1fc1a7
- fix(security): cap bounded-validation tests and correct stale comments
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  babec6b
- fix(security): bound prompt argument schema validation
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  4fc5640
- fix(security): withhold regex output schemas from the SDK validator
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  9096f81
- fix(security): guard proxied output schemas on the direct-proxy path
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  b6aab4b
- feat(security): warn when a registered schema carries a regex keyword
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  0fba852
- fix(security): keep the regex-pattern warning out of the federation failure path
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  698787b
- fix(security): make warn_unprovable_patterns structurally unable to raise
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  d007c0a
- feat(security): log operator regex patterns compiled without a time bound
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  97ad22f
- test(security): prove no validation path reaches an unbounded regex engine
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  fbd2ec2
- test(security): cover the SDK output-schema site and assert rejection content
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  2224155
- test(security): assert the event loop stays responsive under schema ReDoS
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  044df18
- test(security): assert the timeout wording at every bounded-validation site
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  17d84b9
- fix(security): make the never-raises diagnostics true to their docstrings
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  8a649ee
- test(security): pin the event-loop budget and finish the bounded-validation wording
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  9b815ca
- test(e2e): prove a hostile schema pattern cannot stall a live gateway
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  9c5ee49
- fix(test): bound the ReDoS e2e probe by the MCP client timeout
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  e7e0a11
- fix(test): catch the ExceptionGroup a bare McpError handler cannot see
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  65f79ce
- docs(security): record schema validation sandbox changelog
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  013a659
- fix: offload sandboxed schema validation calls to a thread
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  fd68fd6
- test: pass object arguments in schema ReDoS test
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  537197e
- docs: document the JSON Schema regex sandbox
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  dc621cd
- docs: name validate_safely as Validator B's mechanism
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  18cdcbd
- fix(security): fork the schema sandbox only on Linux
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  ce5f3a4
- fix: drop outputSchema withholding after the MCP SDK v2 upgrade
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  a2c8729
- test: cover output-path offload and tool insert listener; document REGEX_* settings
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  336149e
- fix: evaluate sandbox workers once on start
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  fb28a36
- chore: refresh secrets and align sandbox test mocks after rebase
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  cb7cae0
- fix: complete regex warnings and bound output validation test
  
  Suresh Kumar Moharajan
  authored and
  ja8zyjits
  committed
  db4fd3d
- fixed pre-commit
  ja8zyjits
  committed
  1e2c343

Commits

Commits on Oct 1, 2026