Parses and validates JSON text as a §34 replay document, treating the text as
untrusted (§96).
A recording is exactly the kind of file §96 has in mind: it arrives from a bug
report, a CI artifact, or a user's disk, and the first thing the engine does
with it is walk it. So the text length is checked before JSON.parse runs,
and the nesting depth before validateReplayRecording — whose
cloneJsonValue copies of metadata and worldConfiguration recurse once
per level — ever sees the value.
validateReplayRecording itself stays unguarded, deliberately: it is
the entry point for a value the caller built (ReplayRecorder.finish and
ReplayPlayer.load both go through it), and bounding an in-memory object the
process just produced would refuse nothing an attacker controls.
Both bounds default to finite, generous values, so every recording and golden
in this repository decodes exactly as it did before the guard existed.
Parses and validates JSON text as a §34 replay document, treating the text as untrusted (§96).
A recording is exactly the kind of file §96 has in mind: it arrives from a bug report, a CI artifact, or a user's disk, and the first thing the engine does with it is walk it. So the text length is checked before
JSON.parseruns, and the nesting depth before validateReplayRecording — whosecloneJsonValuecopies ofmetadataandworldConfigurationrecurse once per level — ever sees the value.validateReplayRecording itself stays unguarded, deliberately: it is the entry point for a value the caller built (
ReplayRecorder.finishandReplayPlayer.loadboth go through it), and bounding an in-memory object the process just produced would refuse nothing an attacker controls.Both bounds default to finite, generous values, so every recording and golden in this repository decodes exactly as it did before the guard existed.