Skip to content

Fix parseStructTag to reject malformed inputs#898

Open
Danny-Devs wants to merge 1 commit intoMystenLabs:mainfrom
Danny-Devs:danny/harden-parse-struct-tag
Open

Fix parseStructTag to reject malformed inputs#898
Danny-Devs wants to merge 1 commit intoMystenLabs:mainfrom
Danny-Devs:danny/harden-parse-struct-tag

Conversation

@Danny-Devs
Copy link
Contributor

Description

parseStructTag silently accepted inputs with empty components (e.g. ::foo::Bar, where the empty address normalized to 0x0) and inputs with trailing content after type parameters (e.g. Coin<u8>GARBAGE). Both cases produced structurally incorrect StructTag objects without raising an error.

This adds two validation guards:

  1. Empty component rejection: After splitting on ::, validate that address and module are non-empty strings. Previously, ::foo::Bar would silently have its empty address padded to 0x0 by normalizeSuiAddress("").

  2. Trailing content rejection: After extracting name, validate that if type parameters exist (<...>), the string ends with >. Previously, Coin<u8>GARBAGE would silently drop the trailing content.

Both throw Error('Invalid struct tag: ${type}'), consistent with the existing error for inputs with fewer than 3 :: segments.

Test plan

Added 6 test cases to test/unit/types/common.test.ts:

Empty component rejection:

  • ::foo::Bar — empty address
  • 0x2::::Bar — empty module
  • 0x2::foo:: — empty name

Trailing content rejection:

  • 0x2::coin::Coin<u8>GARBAGE — trailing characters
  • 0x2::foo::Bar<bool> — trailing space
  • 0x2::foo::Bar<u64>xyz — trailing alphanumeric

All 290 unit tests pass. Full e2e suite (722 tests) verified against local Sui network via Testcontainers — zero regressions.

parseStructTag silently accepted inputs with empty components
(e.g. ::foo::Bar, where the empty address normalized to 0x0) and
inputs with trailing content after type parameters (e.g.
Coin<u8>GARBAGE). Add validation for non-empty address/module/name
and verify type parameter brackets end the string.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Danny-Devs Danny-Devs requested a review from a team as a code owner February 26, 2026 05:21
@vercel
Copy link

vercel bot commented Feb 26, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sui-typescript-docs Ready Ready Preview, Comment Feb 26, 2026 5:23am

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant