Summary

Fix critical code injection vulnerability in calculator.ts by replacing unsafe eval() with a secure recursive descent math parser.

🔴 Vulnerability (Critical)

File: examples/next-js-chatbot-starter-template/lib/tools/calculator.ts

Using eval() with user-provided expressions allows arbitrary JavaScript code execution. An attacker could execute malicious code through the calculator tool.

Example Attack Vector

// If expression contains: "1; require('child_process').execSync('rm -rf /')"
// eval() will execute this as JavaScript code!
const result = eval(expression);  // DANGEROUS!

✅ Fix

Replaced eval() with a complete secure math expression parser:

1. tokenize() - Lexical analysis to extract numbers, operators, and parentheses
2. parseExpression() - Recursive descent parser with proper operator precedence
3. Whitelist approach - Only allows numeric values and mathematical operators

Before

execute: async ({ expression }) => {
  const result = eval(expression);  // VULNERABLE
  return { result: String(result) };
}

After

// Tokenizer
function tokenize(expr: string): Token[] {
  const tokens: Token[] = [];
  let i = 0;
  while (i < expr.length) {
    // Handle numbers, operators, parentheses
    // Reject anything else
  }
  return tokens;
}

// Recursive descent parser
function parseExpression(tokens: Token[]): number {
  // Handles +, -, *, /, ** with proper precedence
  // Only processes validated tokens
}

execute: async ({ expression }) => {
  const tokens = tokenize(expression);
  const result = parseExpression(tokens);  // SAFE
  return { result: String(result) };
}

Supported Operations

Testing

• Basic arithmetic operations work correctly
• Operator precedence is respected
• Parentheses grouping works
• Malicious JavaScript code is rejected
• Invalid characters cause parsing errors

References

• CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code
• OWASP Code Injection

Summary by cubic

Replaced unsafe eval() in the calculator tool with a safe math expression parser to prevent code injection. Supports +, -, *, /, **, and parentheses with correct precedence.

• Bug Fixes
  • Removed eval(); added tokenizer and recursive descent parser.
  • Whitelists numbers and math operators; rejects invalid characters.
  • Returns clear error messages from execute() instead of a generic failure.

^{Written for commit 3f20266. Summary will update on new commits.}

Summary by CodeRabbit

• New Features

  • Added support for exponentiation operator (**) in mathematical expressions.

• Bug Fixes

  • Improved error handling with clearer error messages for invalid calculations.
  • Enhanced calculator robustness and operational reliability.

_{✏️ Tip: You can customize this high-level summary in your review settings.}