Skip to content

fix: Clone JsonRpcEngineV2 results to prevent returning frozen objects#8077

Merged
FrederikBolding merged 4 commits intomainfrom
fb/json-rpc-engine-v2-dont-leak-freeze
Mar 2, 2026
Merged

fix: Clone JsonRpcEngineV2 results to prevent returning frozen objects#8077
FrederikBolding merged 4 commits intomainfrom
fb/json-rpc-engine-v2-dont-leak-freeze

Conversation

@FrederikBolding
Copy link
Member

@FrederikBolding FrederikBolding commented Mar 2, 2026

Explanation

JsonRpcEngineV2 internally freezes request and result to prevent middlewares from modifying the objects. This implementation detail has leaked into the result returned from handle which does not seem expected and is causing problems downstream. To work around this issue, this PR adds logic to clone the result before returning it, undoing any frozen objects.

References

https://consensyssoftware.atlassian.net/browse/WPC-510


Note

Medium Risk
Changes the runtime behavior of JsonRpcEngineV2.handle() by returning deep-cloned results (new object identities) instead of the internally frozen objects, which may affect consumers relying on referential equality or immutability and adds cloning overhead.

Overview
JsonRpcEngineV2.handle() now deep-clones the final middleware result before returning it, so callers no longer receive the engine’s internally frozen objects (and the return type is no longer Readonly).

Adds coverage to ensure returned objects (including nested objects) are not frozen, updates downstream cache middleware tests to use toStrictEqual instead of reference equality, and records the fix in the json-rpc-engine changelog.

Written by Cursor Bugbot for commit ca7e6d5. This will update automatically on new commits. Configure here.

@FrederikBolding FrederikBolding requested review from a team as code owners March 2, 2026 09:48
Copy link
Member

@mikesposito mikesposito left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@FrederikBolding FrederikBolding added this pull request to the merge queue Mar 2, 2026
Merged via the queue into main with commit 5e32e78 Mar 2, 2026
314 checks passed
@FrederikBolding FrederikBolding deleted the fb/json-rpc-engine-v2-dont-leak-freeze branch March 2, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants