Description

The UI updates state.sessionsResult.sessions directly from realtime gateway events via applySessionsChangedEvent(...).

• The event payload is treated as an untrusted unknown record and a key is extracted from payload.session.key / payload.sessionKey / payload.key.
• If that key is not found in the current list, a new GatewaySessionRow is prepended and count is incremented.
• There is no cap on list size and no check that the session key is already known/returned by sessions.list.

If an attacker can cause a client to receive repeated sessions.changed or session.message events containing random/unique keys (e.g., via a compromised/misconfigured gateway broadcast channel, or cross-tenant event leakage), the browser can be forced to grow memory and repeatedly re-render/sort/filter/paginate sessions, leading to client-side resource exhaustion.

Vulnerable code:

const existingIndex = previousRows.findIndex((row) => row.key === key);
...
const sessions =
  existingIndex >= 0
    ? previousRows.map((row, index) => (index === existingIndex ? nextRow : row))
    : [nextRow, ...previousRows];
...
count: existingIndex >= 0 ? state.sessionsResult.count : state.sessionsResult.count + 1,

Recommendation

Treat gateway event payloads as potentially attacker-influenced and prevent unbounded growth.

Options (can be combined):

1. Do not create new rows from events unless the key is already present in state.sessionsResult.sessions.

if (existingIndex < 0) return false; // ignore unknown session keys

2. Cap the maximum number of sessions kept in memory (e.g., respect the current limit filter or a hard cap):

const MAX_EVENT_SESSIONS = 500;
const nextSessions = existingIndex >= 0
  ? previousRows.map((row, i) => (i === existingIndex ? nextRow : row))
  : [nextRow, ...previousRows].slice(0, MAX_EVENT_SESSIONS);

3. Validate key format (length/charset) to avoid attacker-supplied huge strings.

4. Consider rate limiting / debouncing event-driven updates and relying on sessions.list refresh for authoritative state.

Description

The UI merges the gateway/websocket event payload directly into the in-memory GatewaySessionRow without type validation.

• applySessionsChangedEvent(state, payload) accepts payload: unknown, selects source = payload.session ?? payload, then copies an allow-list of fields onto a GatewaySessionRow.
• Because values are assigned verbatim (no runtime schema checks), an attacker who can influence websocket/gateway events can inject type-confused values (e.g., thinkingOptions: "x" or thinkingLevels: {length:1}) that later break rendering logic.
• Example crash: views/sessions.ts assumes row.thinkingOptions is an array and calls .map(...) on it. If an event sets thinkingOptions to a string/object with a truthy length, the page will throw at render time, potentially breaking the sessions UI (client-side DoS).

Vulnerable code:

for (const field of SESSION_EVENT_ROW_FIELDS) {
  if (!hasOwn(source, field)) continue;
  const value = source[field];
  if (value === undefined) {
    delete mutableNext[field];
  } else {
    mutableNext[field] = value; // no validation/coercion
  }
}

And later:

(row.thinkingOptions?.length ? row.thinkingOptions : DEFAULT_THINK_LEVELS).map(...)

Recommendation

Add runtime validation/coercion for sessions.changed / session.message payloads before merging into application state.

Options:

1. Validate with a schema (preferred):

import { z } from "zod";

const SessionRowPatch = z.object({
  key: z.string().min(1),
  thinkingOptions: z.array(z.string()).optional(),
  thinkingLevels: z.array(z.object({ id: z.string(), label: z.string() })).optional(),
  label: z.string().nullable().optional(),
  displayName: z.string().nullable().optional(),
  ​// ...add the rest with correct types...
}).passthrough(false);

const parsed = SessionRowPatch.safeParse(source);
if (!parsed.success) return false;
const patch = parsed.data;

2. Field-by-field guards: only assign mutableNext[field] = value when typeof/Array.isArray checks pass for that field; otherwise ignore the update.

Additionally, treat unexpected types defensively in render paths (e.g., ensure Array.isArray(row.thinkingOptions) before using .map).