Skip to content

fix(utils): harden parseAttributes against non-JSON attribute values#92

Open
Sentinel-Bluebuilder wants to merge 1 commit into
sentinel-official:developmentfrom
Sentinel-Bluebuilder:fix/parse-attributes-non-json
Open

fix(utils): harden parseAttributes against non-JSON attribute values#92
Sentinel-Bluebuilder wants to merge 1 commit into
sentinel-official:developmentfrom
Sentinel-Bluebuilder:fix/parse-attributes-non-json

Conversation

@Sentinel-Bluebuilder

Copy link
Copy Markdown

Summary

JSON.parse(x.value) in `parseAttributes` throws on raw-string attribute values. Cosmos SDK >=0.50 emits event attribute values as plain strings (no JSON quoting), so on any chain past 0.47, calling `parseAttributes` on a real event with one non-JSON attribute crashes the entire parse for that tx.

Sentinel chain hasn't bitten this yet because of where it sits on the SDK fork tree, but every consumer using this helper against another Cosmos chain hits it on day 1, and it will bite once Sentinel rebases.

Diff

```diff
export function parseAttributes(attributes: readonly Attribute[] | Attribute[]): any {

  • return Object.fromEntries(attributes.map((x: Attribute) => [
  •    x.key.replace(/_([a-z])/g, (_, p1) => p1.toUpperCase()),
    
  •    JSON.parse(x.value)
    
  • ]))
  • return Object.fromEntries(attributes.map((x: Attribute) => {
  •    const key = x.key.replace(/_([a-z])/g, (_, p1) => p1.toUpperCase());
    
  •    try { return [key, JSON.parse(x.value)]; }
    
  •    catch { return [key, x.value]; }
    
  • }))
    }
    ```

Why this is safe

Already-JSON values still parse identically. The only behavior change is raw strings round-trip as raw strings instead of throwing. No reasonable consumer was relying on the throw — a thrown `parseAttributes` is always a bug at the call site.

Test plan

  • `npx tsc --noEmit` passes
  • JSON-quoted values still decode (unchanged path)
  • Raw-string values now return as the raw string instead of throwing

`JSON.parse(x.value)` throws on raw-string attribute values, breaking the
entire event parse for that tx. Cosmos SDK >=0.50 emits attribute values
as plain strings (no JSON quoting), so any chain past 0.47 hits this
immediately on real events.

Wrap the parse in try/catch and fall back to the raw string. Already-JSON
values still parse identically; only behavior change is that raw strings
round-trip as raw strings instead of throwing.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant