Add input validation to getObjectSchema implementations for security

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/runner/src/lib/mockDataSource.ts

@@ -41,6 +41,10 @@ export class MockDataSource implements DataSource {
   }
 
   async getObjectSchema(objectName: string): Promise<any> {
+    if (!objectName || typeof objectName !== 'string') {
+      throw new Error('Invalid object name');
+    }
+    
     console.log(`[DataSource] Getting schema for ${objectName}`);
     // Return a minimal schema for mock purposes
     return {

packages/types/examples/rest-data-source.ts

@@ -171,7 +171,16 @@ export class RestDataSource<T = any> implements DataSource<T> {
    * Get object schema/metadata
    */
   async getObjectSchema(objectName: string): Promise<any> {
-    const url = `${this.baseUrl}/_schema/${objectName}`;
+    if (!objectName || typeof objectName !== 'string') {
+      throw new Error('Invalid object name');
+    }
+    
+    // Validate object name to prevent path traversal
+    if (objectName.includes('/') || objectName.includes('\\') || objectName.includes('..')) {
+      throw new Error('Invalid object name: must not contain path separators');
+    }
+    
+    const url = `${this.baseUrl}/_schema/${encodeURIComponent(objectName)}`;
 
     const response = await fetch(url);