$ the-wire · showcase
Buffa strict parsers: unknown fields and bad descriptor indices now rejected
By RepoJournal · Filed · About Anthropic
Buffa's textproto parsers and DescriptorPool now reject malformed input by default, closing silent-acceptance holes that mismatched upstream protobuf behavior.
Generated textproto parsers in buffa now return `UnknownField` for unknown field names, where a typo like `user_nmae` was previously ignored. The strict behavior covers nested messages, map entries, the built-in `Any` parser, and empty messages, matching "the default behavior of upstream protobuf text parsers." Hand-written `TextFormat` implementations can still opt into lenient handling. [1]
DescriptorPool now validates descriptor sets more strictly on two fronts: out-of-range `public_dependency` and `weak_dependency` indices are rejected, and duplicate `reserved_name` entries on messages and enums are rejected. Previously, a file with `public_dependency: [7]` and no dependencies linked without complaint, and repeated reserved names were silently deduplicated. Both changes mirror protoc's behavior. This is a breaking change for any descriptor sets that relied on the old leniency. [2] [3]
Action items
- → Regenerate textproto parsers and update code that relied on lenient unknown-field handling before upgrading buffa anthropics/buffa [immediate]
- → Validate descriptor sets for out-of-range public_dependency and weak_dependency indices and duplicate reserved names before upgrading anthropics/buffa [immediate]
References
- [1] text: reject unknown fields by default ↗ anthropics/buffa
- [2] descriptor: reject out-of-range dependency indices ↗ anthropics/buffa
- [3] descriptor: reject duplicate reserved names ↗ anthropics/buffa