Imported configuration JSON is not validated — malformed data causes silent failures or crashes #12

New issue

Closed

opened 2026-05-09 05:19:14 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 05:19:14 +00:00

Owner

Severity: Medium

File: src/hooks/useWizard.tsx lines 234-246

Issue: The importConfig function performs no validation of the imported JSON structure beyond checking for a state key. If the imported data contains incorrect types, malformed nested objects, or arbitrary extra keys, the state will silently accept malformed data. This can lead to crashes when UI components expect certain types.

Recommendation: Use Zod schema validation to validate the imported JSON against the WizardState type before applying it.

**Severity:** Medium **File:** `src/hooks/useWizard.tsx` lines 234-246 **Issue:** The `importConfig` function performs no validation of the imported JSON structure beyond checking for a `state` key. If the imported data contains incorrect types, malformed nested objects, or arbitrary extra keys, the state will silently accept malformed data. This can lead to crashes when UI components expect certain types. **Recommendation:** Use Zod schema validation to validate the imported JSON against the WizardState type before applying it.