Severity
Medium — three related fidelity gaps in file parsing/conversion.
What happens
- Nested JSON:
parseJsonFile keeps nested objects as-is and inferHeaders includes keys like attributes; CSV/XML writers do String(value) → literal [object Object] in output; JSON→CSV→JSON round trips lose all nested content (src/ui/utils/fileParse.ts:59-67 + csv.ts:11/xml.ts:17).
- Excel input:
sheet_to_json(sheet, { defval: null, raw: false }) returns formatted display text — a 16-digit numeric ID cell becomes "1.23457E+15", dates come through as e.g. "1/5/26" (fileParse.ts:130). Parse with raw: true, cellDates: true and format dates to ISO explicitly.
- Own output unreadable: JSON exports with metadata (and all JSON downloads from push-history details, where
includeMetadata is hardcoded) produce {exportedAt, …, records:[…]}; parseJsonFile treats the wrapper as a single record — re-importing your own error file yields "1 record" with junk columns (fileParse.ts:59-67 vs export.ts:147-155, PushHistoryDetail.tsx:58). Unwrap parsed.records when the root is a non-array object.
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).
Severity
Medium — three related fidelity gaps in file parsing/conversion.
What happens
parseJsonFilekeeps nested objects as-is andinferHeadersincludes keys likeattributes; CSV/XML writers doString(value)→ literal[object Object]in output; JSON→CSV→JSON round trips lose all nested content (src/ui/utils/fileParse.ts:59-67+csv.ts:11/xml.ts:17).sheet_to_json(sheet, { defval: null, raw: false })returns formatted display text — a 16-digit numeric ID cell becomes"1.23457E+15", dates come through as e.g."1/5/26"(fileParse.ts:130). Parse withraw: true, cellDates: trueand format dates to ISO explicitly.includeMetadatais hardcoded) produce{exportedAt, …, records:[…]};parseJsonFiletreats the wrapper as a single record — re-importing your own error file yields "1 record" with junk columns (fileParse.ts:59-67vsexport.ts:147-155,PushHistoryDetail.tsx:58). Unwrapparsed.recordswhen the root is a non-array object.Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).