From d3f6126583d71755d16d1d062deb8f61109145a2 Mon Sep 17 00:00:00 2001 From: TINGyu123644 <2663180454@qq.com> Date: Sun, 1 Nov 2026 11:20:37 +0800 Subject: [PATCH] fix(libs): reject non-dict output in parse_and_check_json_markdown parse_and_check_json_markdown only special-cases lists; any other non-dict object falls through to the `key not in json_obj` check: - a valid JSON scalar (e.g. a fenced `42`, `null` or `true`, which parse_json_markdown explicitly supports via its fence fallback) raises TypeError instead of the contract OutputParserError; - a valid JSON string passes validation via substring matching whenever an expected key appears inside the string, and is returned to callers that then crash indexing it. Enforce that the parsed object is a dict (or a single-element list wrapping a dict) and raise OutputParserError otherwise. Verified against the existing unit tests plus new regression tests. --- api/libs/json_in_md_parser.py | 6 ++++++ api/tests/unit_tests/libs/test_json_in_md_parser.py | 13 +++++++++++++ 2 files changed, 19 insertions(+) diff --git a/api/libs/json_in_md_parser.py b/api/libs/json_in_md_parser.py index a59fd1eb805798..1619e79928b11d 100644 --- a/api/libs/json_in_md_parser.py +++ b/api/libs/json_in_md_parser.py @@ -56,6 +56,12 @@ def parse_and_check_json_markdown(text: str, expected_keys: list[str]): json_obj = json_obj[0] else: raise OutputParserError(f"got invalid return object. obj:{json_obj}") + if not isinstance(json_obj, dict): + # Scalars or plain strings (e.g. a fenced number/string) are not a + # valid return object. Without this check, `key not in json_obj` + # raises TypeError for numbers/None/bools and silently does a + # substring match for strings. + raise OutputParserError(f"got invalid return object. obj:{json_obj}") for key in expected_keys: if key not in json_obj: raise OutputParserError( diff --git a/api/tests/unit_tests/libs/test_json_in_md_parser.py b/api/tests/unit_tests/libs/test_json_in_md_parser.py index 48b6f749a83a9c..9535a6e72f5f26 100644 --- a/api/tests/unit_tests/libs/test_json_in_md_parser.py +++ b/api/tests/unit_tests/libs/test_json_in_md_parser.py @@ -124,3 +124,16 @@ def test_parse_json_markdown_backtick_in_surrounding_prose() -> None: def test_parse_json_markdown_fenced_scalar_still_supported() -> None: """Fenced content without brackets still parses via the fence fallback.""" assert parse_json_markdown('```json\n"hello"\n```') == "hello" + + +def test_parse_and_check_json_markdown_fenced_scalar_raises_output_parser_error() -> None: + """A valid JSON scalar (number/null/bool) must raise OutputParserError, not TypeError.""" + for src in ("```json\n42\n```", "```json\nnull\n```", "```json\ntrue\n```"): + with pytest.raises(OutputParserError): + parse_and_check_json_markdown(src, ["answer"]) + + +def test_parse_and_check_json_markdown_rejects_non_dict_object() -> None: + """A JSON string that merely contains an expected key as a substring must not pass.""" + with pytest.raises(OutputParserError): + parse_and_check_json_markdown('```json\n"the generated prompt text"\n```', ["prompt"])