handle case when tojson throws an error (#134)

* handle case when tojson throws

* return invalid object instead of null

* add logs

Author: IlyasShabi

src/convert.cpp

@@ -39,7 +39,13 @@ ddwaf_object* to_ddwaf_object_array(
   if (!ignoreToJSON) {
     Napi::Value toJSON = arr.Get("toJSON");
     if (toJSON.IsFunction()) {
-      return to_ddwaf_object(object, env, toJSON.As<Napi::Function>().Call(arr, {}), depth, lim, true, stack, metrics);
+      Napi::Value toJSONResult = toJSON.As<Napi::Function>().Call(arr, {});
+      if (env.IsExceptionPending()) {
+        mlog("Exception pending");
+        env.GetAndClearPendingException();
+        return ddwaf_object_invalid(object);
+      }
+      return to_ddwaf_object(object, env, toJSONResult, depth, lim, true, stack, metrics);
     }
   }
 
@@ -88,7 +94,13 @@ ddwaf_object* to_ddwaf_object_object(
   if (!ignoreToJSON) {
     Napi::Value toJSON = obj.Get("toJSON");
     if (toJSON.IsFunction()) {
-      return to_ddwaf_object(object, env, toJSON.As<Napi::Function>().Call(obj, {}), depth, lim, true, stack, metrics);
+      Napi::Value toJSONResult = toJSON.As<Napi::Function>().Call(obj, {});
+      if (env.IsExceptionPending()) {
+        mlog("Exception pending");
+        env.GetAndClearPendingException();
+        return ddwaf_object_invalid(object);
+      }
+      return to_ddwaf_object(object, env, toJSONResult, depth, lim, true, stack, metrics);
     }
   }
 

test/index.js

@@ -1303,6 +1303,37 @@ describe('limit tests', () => {
     })
   })
 
+  it('should handle toJSON errors gracefully with invalid fallback', () => {
+    const body = {
+      a: {
+        toJSON: function () {
+          throw new Error('error')
+        }
+      },
+      c: 'c'
+    }
+
+    const waf = new DDWAF(processor)
+    const context = waf.createContext()
+    const result = context.run({
+      persistent: {
+        'server.request.body': body,
+        'waf.context.processor': {
+          'extract-schema': true
+        }
+      }
+    }, TIMEOUT)
+
+    assert.deepStrictEqual(result.derivatives, {
+      'server.request.body.schema': [
+        {
+          a: [0],
+          c: [8]
+        }
+      ]
+    })
+  })
+
   it('should truncate string values exceeding maximum length', () => {
     const waf = new DDWAF(rules)