fix(core): reject invalid JSON-RPC params

.changeset/validate-json-rpc-params.md

@@ -0,0 +1,5 @@
+---
+"@aws-blocks/core": patch
+---
+
+Reject primitive and null JSON-RPC params with the standard Invalid Params error.

packages/core/src/rpc.test.ts

@@ -71,3 +71,66 @@ describe('-32600 Invalid Request error shape', () => {
     }
   });
 });
+
+describe('-32602 Invalid Params validation', () => {
+  it('accepts positional array params', () => {
+    const result = parseRpcRequest(JSON.stringify({
+      jsonrpc: '2.0',
+      method: 'api.echo',
+      params: ['hello', 42],
+      id: 1,
+    }));
+
+    assert.strictEqual(result.ok, true);
+    if (result.ok) {
+      assert.deepStrictEqual(result.request.args, ['hello', 42]);
+    }
+  });
+
+  it('accepts named object params', () => {
+    const result = parseRpcRequest(JSON.stringify({
+      jsonrpc: '2.0',
+      method: 'api.echo',
+      params: { message: 'hello', count: 42 },
+      id: 2,
+    }));
+
+    assert.strictEqual(result.ok, true);
+    if (result.ok) {
+      assert.deepStrictEqual(result.request.args, ['hello', 42]);
+    }
+  });
+
+  it('treats omitted params as no arguments', () => {
+    const result = parseRpcRequest(JSON.stringify({
+      jsonrpc: '2.0',
+      method: 'api.ping',
+      id: 3,
+    }));
+
+    assert.strictEqual(result.ok, true);
+    if (result.ok) {
+      assert.deepStrictEqual(result.request.args, []);
+    }
+  });
+
+  for (const params of ['abc', 42, true, false, null]) {
+    it(`rejects ${JSON.stringify(params)} params`, () => {
+      const result = parseRpcRequest(JSON.stringify({
+        jsonrpc: '2.0',
+        method: 'api.echo',
+        params,
+        id: 'request-1',
+      }));
+
+      assert.strictEqual(result.ok, false);
+      if (!result.ok) {
+        const response = JSON.parse(result.response);
+        assert.strictEqual(response.error.code, RpcErrorCode.InvalidParams);
+        assert.strictEqual(response.error.data.name, 'InvalidParams');
+        assert.ok(response.error.message.includes('expected an array or object'));
+        assert.strictEqual(response.id, 'request-1');
+      }
+    });
+  }
+});

packages/core/src/rpc.ts

@@ -118,15 +118,31 @@ export function parseRpcRequest(bodyText: string): RpcParseResult {
     };
   }
 
+  const hasParams = Object.hasOwn(parsed, 'params');
+  if (hasParams && (parsed.params === null || typeof parsed.params !== 'object')) {
+    return {
+      ok: false,
+      response: errorResponse(
+        RpcErrorCode.InvalidParams,
+        'Invalid params: expected an array or object',
+        id,
+        { name: 'InvalidParams' },
+      ),
+    };
+  }
+
+  let args: unknown[] = [];
+  if (hasParams) {
+    args = Array.isArray(parsed.params) ? parsed.params : Object.values(parsed.params);
+  }
+
   return {
     ok: true,
     request: {
       apiNamespace: parsed.method.substring(0, dotIndex),
       method: parsed.method.substring(dotIndex + 1),
-      // JSON-RPC 2.0 §4.2: params may be an array (positional) or object (named).
-      args: Array.isArray(parsed.params)
-        ? parsed.params
-        : Object.values(parsed.params ?? {}),
+      // JSON-RPC 2.0 §4.2: params may be array (positional), object (named), or omitted (empty).
+      args,
       id,
     },
   };