Add protections for loop-bound injections

christopherholland-workday · christopherholland-workday · commit b0eae70c329e · 2026-02-25T14:57:06.000-08:00
diff --git a/packages/server/src/services/evaluations/EvaluatorRunner.ts b/packages/server/src/services/evaluations/EvaluatorRunner.ts
@@ -17,7 +17,7 @@ export const runAdditionalEvaluators = async (
     selectedEvaluators: string[],
     workspaceId: string
 ) => {
-    // Validate inputs are arrays and enforce size limits
+    // Validate that inputs are arrays
     if (!Array.isArray(actualOutputArray) || !Array.isArray(selectedEvaluators)) {
         throw new Error('Invalid input: expected arrays')
     }
diff --git a/packages/server/src/services/evaluations/index.ts b/packages/server/src/services/evaluations/index.ts
@@ -78,7 +78,8 @@ const createEvaluation = async (body: ICommonObject, baseURL: string, orgId: str
             throw new Error('chatflowType must be a valid array')
         }
 
-        const simpleEvaluators = body.selectedSimpleEvaluators && body.selectedSimpleEvaluators.length > 0 ? JSON.parse(body.selectedSimpleEvaluators) : []
+        const simpleEvaluators =
+            body.selectedSimpleEvaluators && body.selectedSimpleEvaluators.length > 0 ? JSON.parse(body.selectedSimpleEvaluators) : []
         if (!Array.isArray(simpleEvaluators)) {
             throw new Error('selectedSimpleEvaluators must be a valid array')
         }
@@ -90,7 +91,8 @@ const createEvaluation = async (body: ICommonObject, baseURL: string, orgId: str
         }
 
         if (body.evaluationType === 'llm') {
-            const lLMEvaluators = body.selectedLLMEvaluators && body.selectedLLMEvaluators.length > 0 ? JSON.parse(body.selectedLLMEvaluators) : []
+            const lLMEvaluators =
+                body.selectedLLMEvaluators && body.selectedLLMEvaluators.length > 0 ? JSON.parse(body.selectedLLMEvaluators) : []
 
             if (!Array.isArray(lLMEvaluators)) {
                 throw new Error('selectedLLMEvaluators must be a valid array')

Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ export const runAdditionalEvaluators = async (`
`17`	`17`	`selectedEvaluators: string[],`
`18`	`18`	`workspaceId: string`
`19`	`19`	`) => {`
`20`		`- // Validate inputs are arrays and enforce size limits`
	`20`	`+ // Validate that inputs are arrays`
`21`	`21`	`if (!Array.isArray(actualOutputArray) \|\| !Array.isArray(selectedEvaluators)) {`
`22`	`22`	`throw new Error('Invalid input: expected arrays')`
`23`	`23`	`}`
Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,8 @@ const createEvaluation = async (body: ICommonObject, baseURL: string, orgId: str`
`78`	`78`	`throw new Error('chatflowType must be a valid array')`
`79`	`79`	`}`
`80`	`80`
`81`		`- const simpleEvaluators = body.selectedSimpleEvaluators && body.selectedSimpleEvaluators.length > 0 ? JSON.parse(body.selectedSimpleEvaluators) : []`
	`81`	`+ const simpleEvaluators =`
	`82`	`+ body.selectedSimpleEvaluators && body.selectedSimpleEvaluators.length > 0 ? JSON.parse(body.selectedSimpleEvaluators) : []`
`82`	`83`	`if (!Array.isArray(simpleEvaluators)) {`
`83`	`84`	`throw new Error('selectedSimpleEvaluators must be a valid array')`
`84`	`85`	`}`
`@@ -90,7 +91,8 @@ const createEvaluation = async (body: ICommonObject, baseURL: string, orgId: str`
`90`	`91`	`}`
`91`	`92`
`92`	`93`	`if (body.evaluationType === 'llm') {`
`93`		`- const lLMEvaluators = body.selectedLLMEvaluators && body.selectedLLMEvaluators.length > 0 ? JSON.parse(body.selectedLLMEvaluators) : []`
	`94`	`+ const lLMEvaluators =`
	`95`	`+ body.selectedLLMEvaluators && body.selectedLLMEvaluators.length > 0 ? JSON.parse(body.selectedLLMEvaluators) : []`
`94`	`96`
`95`	`97`	`if (!Array.isArray(lLMEvaluators)) {`
`96`	`98`	`throw new Error('selectedLLMEvaluators must be a valid array')`