validateFindings accepts line <= 0, empty strings and unknown keys #141

New issue

Closed

opened 2026-08-15 14:33:42 +00:00 by john · 0 comments

john commented

2026-08-15 14:33:42 +00:00

Owner

Source: deep dive F14
Verdict: AGREE - low

Claim as reviewed

Local provider-result validation requires only an integer line and string fields. It accepts zero or negative line numbers, empty file/claim/scenario strings, unexpected properties, arbitrarily many findings and arbitrarily large fields, despite the canonical schema specifying additionalProperties: false.

At HEAD `f354864` (v3.3.0)

cadence-core/bin/review-provider.mjs:746-756. The loop checks typeof f[k] !== 'string' for file/claim/failure_scenario, Number.isInteger(f.line), and SEVERITY.includes(f.severity). Nothing else.

Note

This is a degradation guard against a schema-ignoring model, and its output goes to a human for triage, so it is not a trust boundary. Worth tightening for signal quality: line >= 1, non-empty trimmed strings, exact key set, and field-length plus finding-count caps.

**Source:** deep dive F14 **Verdict:** AGREE - low ### Claim as reviewed Local provider-result validation requires only an integer `line` and string fields. It accepts zero or negative line numbers, empty file/claim/scenario strings, unexpected properties, arbitrarily many findings and arbitrarily large fields, despite the canonical schema specifying `additionalProperties: false`. ### At HEAD f354864 (v3.3.0) `cadence-core/bin/review-provider.mjs:746-756`. The loop checks `typeof f[k] !== 'string'` for `file`/`claim`/`failure_scenario`, `Number.isInteger(f.line)`, and `SEVERITY.includes(f.severity)`. Nothing else. ### Note This is a degradation guard against a schema-ignoring model, and its output goes to a human for triage, so it is not a trust boundary. Worth tightening for signal quality: `line >= 1`, non-empty trimmed strings, exact key set, and field-length plus finding-count caps.