chalk-it icon indicating copy to clipboard operation
chalk-it copied to clipboard

Add security validation for select widgets with mismatched keys and values arrays

Open Copilot opened this issue 6 months ago • 0 comments

This PR adds validation to select widgets to prevent data loss when keys and values arrays have different lengths.

Problem

Previously, select widgets would silently lose data when keys and values arrays had different lengths. The render function used Math.min(keys.length, values.length) to determine the number of options, causing:

  • Missing options when keys array was longer than values array
  • Missing values when values array was longer than keys array

For example:

// Keys: ["Red", "Green", "Blue", "Yellow"]  
// Values: ["#FF0000", "#00FF00"]
// Result: Only 2 options created, "Blue" and "Yellow" are lost

Solution

Added custom validator functions to the WidgetActuatorDescription constructors that:

  1. Check if both keys and values arrays exist and have elements
  2. Validate that they have the same length when both are present
  3. Return descriptive error messages for length mismatches
  4. Pass validation when arrays match or when only one array is provided

Changes

  • Added WidgetActuatorValidationError import
  • Created validateKeysValuesConsistency() function
  • Applied validation to all relevant actuator descriptors:
    • _KEYS_DESCRIPTOR
    • _VALUES_STRING_DESCRIPTOR
    • _VALUES_NUMBER_DESCRIPTOR
    • _VALUES_BOOLEAN_DESCRIPTOR

Validation Demo

Validation Demo

The validation correctly handles all scenarios:

  • Valid configurations with matching array lengths pass
  • Invalid configurations with length mismatches fail with clear error messages like "Keys array length (4) must match values array length (2)"
  • Edge cases like empty arrays or single-array configurations pass appropriately

Users now get immediate feedback about array inconsistencies instead of silent data loss, improving the security and reliability of select widgets.

Fixes #65.


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Copilot avatar Aug 29 '25 15:08 Copilot