fix(executor): escape resolved references in while/doWhile loop conditions

Loop conditions inlined each resolved reference as a bare double-quoted
literal before compiling the expression in the execution isolate, so a
quote anywhere in the referenced value broke out of the literal and ran
as code. Serialize operands as proper JS literals instead, and cap
condition-driven loops, which had no iteration ceiling at all.

Author: waleedlatif1

apps/sim/executor/orchestrators/loop.test.ts

@@ -308,6 +308,98 @@ describe('LoopOrchestrator', () => {
     )
   })
 
+  describe('while condition reference interpolation', () => {
+    async function evaluateWhileConditionFor(condition: string, resolved: unknown) {
+      const resolver = { resolveSingleReference: vi.fn().mockResolvedValue(resolved) }
+      const orchestrator = new LoopOrchestrator(
+        { loopConfigs: new Map(), parallelConfigs: new Map(), nodes: new Map() } as any,
+        createState(),
+        resolver as any
+      )
+      const ctx = createContext({
+        iteration: 0,
+        currentIterationOutputs: new Map(),
+        allIterationOutputs: [],
+        loopType: 'while',
+        condition,
+      })
+
+      await orchestrator.evaluateInitialCondition(ctx, 'loop-1')
+
+      return mockExecuteInIsolatedVM.mock.calls[0][0].code as string
+    }
+
+    it('does not let a quote in a resolved value escape into expression position', async () => {
+      const payload = 'z" ) && Boolean( "INJ".length === 3 ) && Boolean( "never'
+
+      const code = await evaluateWhileConditionFor('<start.input> === "never"', payload)
+
+      expect(new Function(code)()).toBe(false)
+      expect(code).toBe(`return Boolean(${JSON.stringify(payload)} === "never")`)
+    })
+
+    it('escapes backslashes and newlines so the condition stays compilable', async () => {
+      const code = await evaluateWhileConditionFor('<start.input> === "x"', 'a\\"\nb')
+
+      expect(() => new Function(code)).not.toThrow()
+      expect(new Function(code)()).toBe(false)
+    })
+
+    it('escapes line separators that are legal in JSON but not in every JS host', async () => {
+      const code = await evaluateWhileConditionFor('<start.input> === "x"', 'a\u2028b\u2029c')
+
+      expect(code).not.toMatch(/[\u2028\u2029]/)
+      expect(new Function(code)()).toBe(false)
+    })
+
+    it.each([
+      ['TRUE', 'return Boolean(true)'],
+      [' false ', 'return Boolean(false)'],
+      [7, 'return Boolean(7)'],
+      [true, 'return Boolean(true)'],
+      [null, 'return Boolean(null)'],
+      [{ a: 1 }, 'return Boolean({"a":1})'],
+    ])('serializes %o as a literal operand', async (resolved, expected) => {
+      expect(await evaluateWhileConditionFor('<start.input>', resolved)).toBe(expected)
+    })
+  })
+
+  it('exits condition-driven loops at the hard iteration ceiling', async () => {
+    const { orchestrator } = createOrchestrator()
+    const ctx = createContext({
+      iteration: 9999,
+      loopType: 'while',
+      condition: 'true',
+      currentIterationOutputs: new Map(),
+      allIterationOutputs: [],
+    })
+
+    const result = await orchestrator.evaluateLoopContinuation(ctx, 'loop-1')
+
+    expect(result).toMatchObject({
+      shouldContinue: false,
+      shouldExit: true,
+      selectedRoute: EDGE.LOOP_EXIT,
+    })
+    expect(mockExecuteInIsolatedVM).not.toHaveBeenCalled()
+  })
+
+  it('keeps evaluating condition-driven loops below the hard iteration ceiling', async () => {
+    const { orchestrator } = createOrchestrator()
+    const ctx = createContext({
+      iteration: 9997,
+      loopType: 'while',
+      condition: 'true',
+      currentIterationOutputs: new Map(),
+      allIterationOutputs: [],
+    })
+
+    const result = await orchestrator.evaluateLoopContinuation(ctx, 'loop-1')
+
+    expect(result.shouldContinue).toBe(true)
+    expect(mockExecuteInIsolatedVM).toHaveBeenCalled()
+  })
+
   it('exits doWhile loops when the configured iteration cap is reached', async () => {
     const { orchestrator } = createOrchestrator()
     const ctx = createContext({

apps/sim/executor/orchestrators/loop.ts

@@ -38,6 +38,50 @@ const logger = createLogger('LoopOrchestrator')
 
 const LOOP_CONDITION_TIMEOUT_MS = 5000
 
+/**
+ * Hard ceiling on iterations for condition-driven loops (`while`, and `doWhile`
+ * with an explicit condition). These have no user-configured `maxIterations`, so
+ * a condition that never goes false would otherwise spin an execution worker
+ * indefinitely.
+ */
+const MAX_CONDITION_LOOP_ITERATIONS = 10000
+
+/**
+ * Serializes a resolved reference value into a JavaScript literal for the loop
+ * condition expression.
+ *
+ * The result is concatenated into source that is compiled and run in the
+ * execution isolate, so every value must be emitted as a self-contained literal.
+ * Interpolating a string without escaping would let a `"` in the resolved data
+ * terminate the literal and continue in expression position.
+ */
+function formatConditionOperand(resolved: unknown): string {
+  if (typeof resolved === 'boolean' || typeof resolved === 'number') {
+    return String(resolved)
+  }
+
+  if (typeof resolved === 'string') {
+    const lower = resolved.toLowerCase().trim()
+    if (lower === 'true' || lower === 'false') {
+      return lower
+    }
+  }
+
+  return toJsLiteral(resolved)
+}
+
+/**
+ * JSON-serializes a value and escapes the code points that are valid inside a
+ * JSON string but historically hazardous inside a JavaScript source literal.
+ */
+function toJsLiteral(value: unknown): string {
+  const serialized = JSON.stringify(value)
+  if (serialized === undefined) {
+    return 'undefined'
+  }
+  return serialized.replace(/\u2028/g, String.raw`\u2028`).replace(/\u2029/g, String.raw`\u2029`)
+}
+
 async function replaceLoopConditionReferences(
   condition: string,
   replacer: (match: string) => Promise<string>
@@ -303,7 +347,22 @@ export class LoopOrchestrator {
   }
 
   private hasReachedConfiguredIterationLimit(scope: LoopScope, nextIteration: number): boolean {
-    if (scope.loopType !== 'doWhile' || scope.maxIterations === undefined) {
+    if (scope.maxIterations === undefined) {
+      if (
+        (scope.loopType === 'while' || scope.loopType === 'doWhile') &&
+        nextIteration >= MAX_CONDITION_LOOP_ITERATIONS
+      ) {
+        logger.error('Condition loop hit the iteration ceiling, forcing exit', {
+          loopType: scope.loopType,
+          condition: scope.condition,
+          maxConditionIterations: MAX_CONDITION_LOOP_ITERATIONS,
+        })
+        return true
+      }
+      return false
+    }
+
+    if (scope.loopType !== 'doWhile') {
       return false
     }
     return nextIteration >= scope.maxIterations
@@ -724,17 +783,7 @@ export class LoopOrchestrator {
           resolvedType: resolved === null ? 'null' : typeof resolved,
         })
         if (resolved !== undefined) {
-          if (typeof resolved === 'boolean' || typeof resolved === 'number') {
-            return String(resolved)
-          }
-          if (typeof resolved === 'string') {
-            const lower = resolved.toLowerCase().trim()
-            if (lower === 'true' || lower === 'false') {
-              return lower
-            }
-            return `"${resolved}"`
-          }
-          return JSON.stringify(resolved)
+          return formatConditionOperand(resolved)
         }
         return match
       })