Take js-yaml 5, with guards for the two behaviour changes it brings - #17
Merged
Conversation
js-yaml 5 loads with the YAML 1.2 core schema. Two of the resulting
differences reach code that reads attacker-adjacent files.
load() now throws on a stream that contains no document. The dashboard
reads the agent harness's own config.yaml, a file Agentwall does not own,
so a comment-only or half-written one would take the whole dashboard
state build down rather than one panel. summarizeYamlSource returns the
unknown summary on any parse failure, which covers malformed input too.
Merge keys are no longer expanded, so a policy file that relies on << now
fails schema validation and is rejected whole. FileBackedPolicyRuntime
keeps the last good ruleset on any reload failure; the new cases pin that
for parser-level rejection, not just schema-level rejection.
@types/js-yaml is dropped because js-yaml 5 ships its own declarations.
js-yaml is exact-pinned per the runtime dependency policy.
Verified: require('js-yaml') resolves the CommonJS build and round-trips
load and dump on node 24.14.1; dump output for the config and policy
shapes is byte-identical to 4.3.1; the shipped examples carry no merge
keys, YAML 1.1 booleans, leading-zero octals, or sexagesimal scalars.
Signed-off-by: reesebuilt <[email protected]>
repsecure
force-pushed
the
agent/3.1-js-yaml
branch
from
August 5, 2026 02:55
d5b7ebb to
0855eee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes js-yaml 5.2.3, pinned exactly, and supersedes Dependabot #7 which bumps the range without the guards this change needs.
Policy files are YAML and are attacker-adjacent input, so this was reviewed against the API surface we actually call (5 files, load and dump only, no custom schemas or tags) with a 38-case differential probe run side by side on 4.3.1 and 5.2.3. The security-relevant behaviour is unchanged: duplicate mapping keys are still rejected, unknown tags still throw so
!!js/functionand!!python/objectgadget payloads remain refused, and there is no prototype pollution via__proto__orconstructor.prototype. Starter config and policy dumps are byte-identical, including quoting ofyes,0777,1:30and2026-01-02.Two operator-visible changes did surface, and both are now guarded and tested rather than discovered in production:
@types/js-yamlis removed because 5.x ships its own types.Falsifiers: removing the dashboard guard fails 3 of 4 new cases; making reload() clear its rules on error fails all 4 policy cases. Both restore clean.