Merge pull request #449 from hanazuki/cycle

reject circular objects from native functions

Author: hanazuki

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## UNRELEASED
 
+- Now circular references in the object returned from a native function are detected and reported as an exception, instead of crashing the VM from stack overflow.
+
 ## v3.3.1 (2026-05-24)
 
 - Fix: `importCallback` or `nativeCallback` returning a malformed result now rejects the evaluation with a `JsonnetError` instead of hanging indefinitely.

spec/binding_spec.cjs

@@ -294,6 +294,29 @@ describe('binding', () => {
       .toBeRejectedWithError(JsonnetError, /trap threw/);
   });
 
+  it('rejects a circular object returned from a native callback', async () => {
+    const jsonnet = new Jsonnet();
+    const circular = {};
+    circular.self = circular;
+    jsonnet.nativeCallback('circular', () => circular);
+
+    await expectAsync(jsonnet.evaluateSnippet(`std.native("circular")()`))
+      .toBeRejectedWithError(/Converting circular structure/);
+  });
+
+  it('accepts shared (non-circular) object references from a native callback', async () => {
+    const jsonnet = new Jsonnet();
+    const o = { x: 1 };
+    jsonnet.nativeCallback('inArray', () => [o, o]);
+    jsonnet.nativeCallback('inObject', () => ({ a: o, b: o }));
+
+    let j = await jsonnet.evaluateSnippet(`std.native("inArray")()`);
+    expect(j).toBeJSON([{ x: 1 }, { x: 1 }]);
+
+    j = await jsonnet.evaluateSnippet(`std.native("inObject")()`);
+    expect(j).toBeJSON({ a: { x: 1 }, b: { x: 1 } });
+  });
+
   it('reports throwing async native callback', async () => {
     const jsonnet = new Jsonnet();
 

src/JsonValueConverter.cpp

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: MIT
 #include "JsonValueConverter.hpp"
+#include <algorithm>
 #include <memory>
 #include <utility>
 
@@ -29,6 +30,12 @@ namespace nodejsonnet {
   }
 
   JsonnetJsonValue *JsonValueConverter::toJsonnetJson(Napi::Value v) const {
+    std::vector<Napi::Object> ancestors;
+    return toJsonnetJsonImpl(v, ancestors);
+  }
+
+  JsonnetJsonValue *JsonValueConverter::toJsonnetJsonImpl(
+    Napi::Value v, std::vector<Napi::Object> &ancestors) const {
     if(v.IsBoolean()) {
       return vm->makeJsonBool(v.As<Napi::Boolean>());
     }
@@ -47,22 +54,34 @@ namespace nodejsonnet {
     }
     if(v.IsArray()) {
       auto const array = v.As<Napi::Array>();
+      if(std::any_of(ancestors.begin(), ancestors.end(),
+           [&](auto const &a) { return a.StrictEquals(array); })) {
+        throw Napi::TypeError::New(array.Env(), "Converting circular structure to JSON");
+      }
+      ancestors.push_back(array);
       auto const json = vm->makeJsonArray();
       for(size_t i = 0, len = array.Length(); i < len; ++i) {
-        vm->appendJsonArray(json, toJsonnetJson(array[i]));
+        vm->appendJsonArray(json, toJsonnetJsonImpl(array[i], ancestors));
       }
+      ancestors.pop_back();
       return json;
     }
     if(v.IsObject()) {
       auto const object = v.As<Napi::Object>();
+      if(std::any_of(ancestors.begin(), ancestors.end(),
+           [&](auto const &a) { return a.StrictEquals(object); })) {
+        throw Napi::TypeError::New(object.Env(), "Converting circular structure to JSON");
+      }
+      ancestors.push_back(object);
       auto const json = vm->makeJsonObject();
       auto const props = object.GetPropertyNames();
       for(size_t i = 0, len = props.Length(); i < len; ++i) {
         auto const prop = props[i].ToString();
         if(object.HasOwnProperty(prop)) {
-          vm->appendJsonObject(json, prop, toJsonnetJson(object.Get(prop)));
+          vm->appendJsonObject(json, prop, toJsonnetJsonImpl(object.Get(prop), ancestors));
         }
       }
+      ancestors.pop_back();
       return json;
     }
     return vm->makeJsonNull();

src/JsonValueConverter.hpp

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: MIT
 #pragma once
 #include <memory>
+#include <vector>
 #include <napi.h>
 #include "JsonnetVm.hpp"
 
@@ -14,6 +15,7 @@ namespace nodejsonnet {
 
   private:
     std::shared_ptr<JsonnetVm> vm;
+    JsonnetJsonValue *toJsonnetJsonImpl(Napi::Value v, std::vector<Napi::Object> &ancestors) const;
   };
 
 }