fix(infra): sanitize network data before writing weaviate state

gracefullight · ourfirstfluke · gracefullight · commit e759f0f4b6c5 · 2026-04-08T03:56:45.000+10:00
Validate and coerce API response fields to string before persisting to .weaviate-state.json to prevent untrusted data injection. Fixes code-scanning #12 Generated with oh-my-agent Co-Authored-By: First Fluke <our.first.fluke@gmail.com>
diff --git a/apps/infra/freemium/scripts/weaviate.ts b/apps/infra/freemium/scripts/weaviate.ts
@@ -51,7 +51,12 @@ function readState(): WeaviateState | null {
 }
 
 function writeState(state: WeaviateState): void {
-  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2), "utf-8");
+  const sanitized: WeaviateState = {
+    cluster_id: String(state.cluster_id),
+    url: String(state.url),
+    api_key: String(state.api_key),
+  };
+  writeFileSync(STATE_FILE, JSON.stringify(sanitized, null, 2), "utf-8");
 }
 
 function deleteState(): void {

Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,12 @@ function readState(): WeaviateState \| null {`
`51`	`51`	`}`
`52`	`52`
`53`	`53`	`function writeState(state: WeaviateState): void {`
`54`		`- writeFileSync(STATE_FILE, JSON.stringify(state, null, 2), "utf-8");`
	`54`	`+ const sanitized: WeaviateState = {`
	`55`	`+ cluster_id: String(state.cluster_id),`
	`56`	`+ url: String(state.url),`
	`57`	`+ api_key: String(state.api_key),`
	`58`	`+ };`
	`59`	`+ writeFileSync(STATE_FILE, JSON.stringify(sanitized, null, 2), "utf-8");`
`55`	`60`	`}`
`56`	`61`
`57`	`62`	`function deleteState(): void {`