From 9254e889ffd102506f740418667635030ced0d04 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 13 Jun 2026 17:43:22 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=A7=B9=20[code=20health=20improvement?= =?UTF-8?q?]=20Replace=20`any`=20with=20`unknown`=20in=20`webviewMessageHa?= =?UTF-8?q?ndler.ts`?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/webviewMessageHandler.ts | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/src/webviewMessageHandler.ts b/src/webviewMessageHandler.ts index f62117a..f5e886f 100644 --- a/src/webviewMessageHandler.ts +++ b/src/webviewMessageHandler.ts @@ -21,13 +21,14 @@ interface WebviewLegacyRpcMessage { function isWebviewRpcInvokeMessage(message: unknown): message is WebviewRpcInvokeMessage { if (!message || typeof message !== 'object') return false; - const msg = message as Record; - return msg.channel === 'rpc' && msg.content?.kind === 'invoke'; + const msg = message as Record; + const content = msg.content as Record | undefined; + return msg.channel === 'rpc' && content?.kind === 'invoke'; } function isWebviewLegacyRpcMessage(message: unknown): message is WebviewLegacyRpcMessage { if (!message || typeof message !== 'object') return false; - const msg = message as Record; + const msg = message as Record; return msg.type === 'rpc-request'; } @@ -81,9 +82,9 @@ export class WebviewMessageHandler { // SECURITY: Block Object.prototype methods to prevent prototype pollution attacks. // Allow class prototype methods (e.g., HostBridge.initialize) but reject inherited // Object methods like 'constructor', '__defineGetter__', 'toString'. - if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as Record)[targetMethod] === 'function') { - const fn = (hostBridge as Record)[targetMethod]; - Promise.resolve(fn.apply(hostBridge as any, deserializedPayload)) + if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as Record)[targetMethod] === 'function') { + const fn = (hostBridge as Record)[targetMethod] as Function; + Promise.resolve(fn.apply(hostBridge as unknown, deserializedPayload)) .then(result => { // Serialize result to handle Uint8Array and other typed arrays // which get converted to {} by postMessage JSON serialization @@ -131,9 +132,9 @@ export class WebviewMessageHandler { const hostBridge = this.hostBridge; // SECURITY: Same prototype pollution guard as #handleRpcInvoke if (BLOCKED_METHODS.has(message.method) || !(message.method in hostBridge)) return; - const fn = (hostBridge as Record)[message.method]; + const fn = (hostBridge as Record)[message.method]; if (typeof fn === 'function') { - Promise.resolve(fn.apply(hostBridge as any, deserializeArgs(message.args || []))) + Promise.resolve((fn as Function).apply(hostBridge as unknown, deserializeArgs(message.args || []))) .then(result => { // Serialize result to handle Uint8Array const serializedResult = serializeValue(result); From 396ca0ef6c52d082210f0516df14e38c1e21785d Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 13 Jun 2026 17:54:02 +0000 Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=A7=B9=20[code=20health=20improvement?= =?UTF-8?q?]=20Replace=20`any`=20with=20`unknown`=20in=20`webviewMessageHa?= =?UTF-8?q?ndler.ts`?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- core/ui/viewer.html | 20 ++++++++++---------- src/webviewMessageHandler.ts | 6 +++--- website/public/sqlite-viewer/viewer.html | 16 ++++++++-------- 3 files changed, 21 insertions(+), 21 deletions(-) diff --git a/core/ui/viewer.html b/core/ui/viewer.html index 4a45d4a..09d2954 100644 --- a/core/ui/viewer.html +++ b/core/ui/viewer.html @@ -364,7 +364,7 @@ diff --git a/src/webviewMessageHandler.ts b/src/webviewMessageHandler.ts index f5e886f..e862b1c 100644 --- a/src/webviewMessageHandler.ts +++ b/src/webviewMessageHandler.ts @@ -82,8 +82,8 @@ export class WebviewMessageHandler { // SECURITY: Block Object.prototype methods to prevent prototype pollution attacks. // Allow class prototype methods (e.g., HostBridge.initialize) but reject inherited // Object methods like 'constructor', '__defineGetter__', 'toString'. - if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as Record)[targetMethod] === 'function') { - const fn = (hostBridge as Record)[targetMethod] as Function; + if (!BLOCKED_METHODS.has(targetMethod) && targetMethod in hostBridge && typeof (hostBridge as unknown as Record)[targetMethod] === 'function') { + const fn = (hostBridge as unknown as Record)[targetMethod] as Function; Promise.resolve(fn.apply(hostBridge as unknown, deserializedPayload)) .then(result => { // Serialize result to handle Uint8Array and other typed arrays @@ -132,7 +132,7 @@ export class WebviewMessageHandler { const hostBridge = this.hostBridge; // SECURITY: Same prototype pollution guard as #handleRpcInvoke if (BLOCKED_METHODS.has(message.method) || !(message.method in hostBridge)) return; - const fn = (hostBridge as Record)[message.method]; + const fn = (hostBridge as unknown as Record)[message.method]; if (typeof fn === 'function') { Promise.resolve((fn as Function).apply(hostBridge as unknown, deserializeArgs(message.args || []))) .then(result => { diff --git a/website/public/sqlite-viewer/viewer.html b/website/public/sqlite-viewer/viewer.html index a4add1a..29c4347 100644 --- a/website/public/sqlite-viewer/viewer.html +++ b/website/public/sqlite-viewer/viewer.html @@ -364,7 +364,7 @@