fix(form): add type guard for Gemini env values

Address code audit finding #10:

Replace unsafe type assertion with proper type guard when extracting
custom env config. Convert all values to strings explicitly using
String() to prevent runtime type errors when env contains non-string
values (numbers, booleans, etc).

Before: envObj = customConfig as Record<string, string>
After: Iterate and convert each value with String(value)
This commit is contained in:
YoVinchen
2026-01-26 15:55:58 +08:00
parent 0ecf6891c0
commit e393dda68e
@@ -944,7 +944,12 @@ export function ProviderForm({
const commonEnvObj = envStringToObj(geminiCommonConfigSnippet.trim());
if (isPlainObject(envObj) && isPlainObject(commonEnvObj)) {
const { customConfig } = extractDifference(envObj, commonEnvObj);
envObj = customConfig as Record<string, string>;
// Convert to string record with type guard to avoid type assertion issues
const stringEnvObj: Record<string, string> = {};
for (const [key, value] of Object.entries(customConfig)) {
stringEnvObj[key] = String(value);
}
envObj = stringEnvObj;
}
}
const combined = {