test(renderer): pin the {{var}} injection-safety charset so a loosening can't slip in (#4)#126
Merged
Merged
Conversation
…ng can't slip in (#4) Beta feedback #4 (mutation finding): render()/extractVarReferences use a deliberately strict var-name charset — /\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g — so a template can't reference dotted/hyphenated/ leading-digit keys (`{{a.b}}`, `{{../x}}`, prototype-walking or path-like names). Mutation testing showed the regex can be loosened to admit `.`/`-`/leading-digit and every existing test still passes, because none pins the boundary — they only cover valid names, whitespace, coercion, and malformed braces. Adds two mutation-killing tests: - render() leaves `{{foo.bar}}` / `{{foo-bar}}` / `{{1foo}}` / `{{a b}}` LITERAL (not interpolated), even when a matching key is present in vars, and reports them as un-matched (not unresolved). - extractVarReferences('{{a.b}} {{c-d}} {{1e}}') === []. Verified: both FAIL when the charset is loosened to `[a-zA-Z0-9_.-]+`, and PASS on the real code. Test-only; no behaviour change. Full create-agent-harness suite 383/383; tsc clean. Co-Authored-By: claude-flow <ruv@ruv.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What / why
Closes a mutation-surfaced test gap from the AQE beta feedback (#4).
render()/extractVarReferencesuse a deliberately strict var-name charset —[a-zA-Z_][a-zA-Z0-9_]*— so a template can't reference dotted / hyphenated / leading-digit keys ({{a.b}},{{../x}}, prototype-walking or path-like names). Mutation testing showed the regex can be loosened to admit./-/leading-digit and every existing test still passes — the tests only cover valid names, whitespace, coercion, and malformed braces, never the boundary.Change (test-only)
render()leaves{{foo.bar}}/{{foo-bar}}/{{1foo}}/{{a b}}literal (not interpolated), even when a matching key is present invars, and reports them as un-matched (notunresolved).extractVarReferences('{{a.b}} {{c-d}} {{1e}}') === [].Mutation-kill verified
Loosening the charset to
[a-zA-Z0-9_.-]+makes both new tests fail; they pass on the real code. (Verified locally, then reverted.)Tests
Full
create-agent-harnesssuite 383/383;tscclean. No behaviour change.🤖 Generated with claude-flow