You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
by-position: params MUST be an Array, containing the values in the Server expected order.
by-name: params MUST be an Object, with member names that match the Server expected parameter names. The absence of expected names MAY result in an error being generated. The names MUST match exactly, including case, to the method's expected parameters.
At the time of writing, tower-lsp's Request type does not reject messages with params fields that are not either object-like or array-like. This was done to accommodate the telemetry/event notification which, until recently, erroneously mandated a params type of object | number | boolean | string. Thankfully, this was corrected in the spec: microsoft/language-server-protocol#1686
We already restrict users from emitting non-object and non-array telemetry/event payloads in client.rs, so there's no additional work necessary on that front.
However, we should still update the Request type and LspServiceBuilder::custom_method() to reject params values that are not serializable/deserializable to and from objects/arrays in order to fully comply.
The text was updated successfully, but these errors were encountered:
ebkalderon
changed the title
Restrict JSON-RPC request/notification params only to objects and arrays
Restrict JSON-RPC request/notification params to objects and arrays
Mar 10, 2023
This issue was previously touched on in PR #379. Most of the code in improve-jsonrpc-deserialization that hasn't yet been integrated into mainline covers a big portion of this work already.
According to both the JSON-RPC 2.0 specification and the Language Server Protocol specification, the
params
field in all JSON-RPC requests and notifications must be either:At the time of writing,
tower-lsp
'sRequest
type does not reject messages withparams
fields that are not either object-like or array-like. This was done to accommodate thetelemetry/event
notification which, until recently, erroneously mandated aparams
type ofobject | number | boolean | string
. Thankfully, this was corrected in the spec: microsoft/language-server-protocol#1686We already restrict users from emitting non-object and non-array
telemetry/event
payloads inclient.rs
, so there's no additional work necessary on that front.tower-lsp/src/service/client.rs
Lines 203 to 211 in e96d8ca
However, we should still update the
Request
type andLspServiceBuilder::custom_method()
to rejectparams
values that are not serializable/deserializable to and from objects/arrays in order to fully comply.The text was updated successfully, but these errors were encountered: