fix(parser): guard raw-string hash lookahead at EOF (re-applied from #3867) - #4005
Conversation
This reverts commit a05ec5a.
Re-applies the parser hardening from #3867 (reverted wholesale in #4002 for sequencing): find_token_after_hashes could return the one-past-the- end index after a hash run at EOF, and parse_raw_string indexed tokens with it directly — a panic on incomplete input like a bare `##` at end of file. Return None at EOF and index the call site through get(). Adds the regression test the original fix lacked; verified it panics ("index out of bounds: the len is 15 but the index is 15") without the two guards. Co-authored-by: Avery Townsend <avery@boundaryml.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VEMxti5WQ8bCgJUuX9AQvo
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughRaw-string parsing now handles incomplete hash delimiters at EOF without out-of-bounds indexing. Token lookup returns no position when EOF is reached, quote validation uses safe access, and regression tests cover bare hashes and truncated contexts. ChangesRaw-string EOF handling
Estimated code review effort: 1 (Trivial) | ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
⏭️ Performance benchmarks were skippedPerf benchmarks (CodSpeed) are opt-in on pull requests — they no longer run on every push. They always run automatically after merge to To run them on this PR, do any of the following, then push a commit (or re-run CI):
|
Binary size checks passed✅ 7 passed
Generated by |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@baml_language/crates/baml_compiler_parser/src/parser.rs`:
- Around line 8054-8072: Update the bare_hashes_at_eof_do_not_panic test to
assert that parse_source returns at least one diagnostic for every malformed
input, while retaining the existing no-panic coverage. Use the returned _errors
value and preserve the current source cases.
- Around line 1802-1808: Update the hash-handling flow around
looks_like_config_expression, parse_config_value, and parse_config_block so an
EOF-terminated hash sequence cannot retry the same Hash token indefinitely;
ensure malformed values consume the offending token or otherwise guarantee
parser progress while preserving valid hash parsing. Add a regression case
covering an input such as client<llm> C { key ##.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 7642208b-8ae8-4560-8fb4-53fd1f474553
📒 Files selected for processing (1)
baml_language/crates/baml_compiler_parser/src/parser.rs
…locks Review follow-ups: every malformed case now asserts at least one diagnostic (a silent-accept regression would previously pass), and two config-block cases pin that hash values at EOF neither panic nor loop — config-value recovery leaves the hashes unconsumed and the next config-item iteration consumes them as a malformed key (error + bump). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VEMxti5WQ8bCgJUuX9AQvo
1 participant
Stacked on #4002 (retargets to canary when it merges). Re-applies the one change in #3867 that was a standalone bug fix rather than part of the semantic-tokens feature, so the revert doesn't reintroduce it — addressing CodeRabbit's Critical finding on #4002.
find_token_after_hashescould return the one-past-the-end index after a hash run at EOF, andparse_raw_stringindexedtokenswith it directly — a panic on incomplete input like a bare##at end of file, present on canary long before #3867. Under the new LSP core (#4000) a parser panic on the source path additionally poisons the project into a terminal broken state, so this class matters more now.Both hunks are byte-for-byte @codeshaunted's fix from #3867 (credited as co-author). New here: the regression test the original lacked — verified to panic (
index out of bounds: the len is 15 but the index is 15) with the guards removed, and covering bare#/##at top level, inside expression bodies, and afterlet.Validation:
cargo test -p baml_compiler_parser140/140 (139 pre-existing + the new test), clippy-D warningsclean.🤖 Generated with Claude Code
https://claude.ai/code/session_01VEMxti5WQ8bCgJUuX9AQvo
Summary by CodeRabbit