fix: parse adjacency-list values for non-root paths

[andrewkolos]

Description

Fixes #710. That issue has a detailed technical breakdown, so I won't duplicate one here.

Pre-launch Checklist

• I read the Flutter Style Guide recently, and have followed its advice.
• I signed the CLA.
• I read the Contributors Guide.
• I have added sample code updates to the changelog.
• I updated/added relevant documentation (doc comments with ///).

[gemini-code-assist]

Code Review

The pull request effectively addresses the issue of parsing adjacency-list values for non-root paths by introducing a parsedContents variable. This ensures that list-based content is correctly transformed into a map structure before being applied to the data model, whether at the root or a nested path. The addition of a dedicated test case for non-root path parsing further validates the fix and improves test coverage. The changes are clear, concise, and directly resolve the reported problem.

[andrewkolos]

/gemini review

[gemini-code-assist]

Code Review

This pull request correctly fixes an issue where adjacency-list values were not being parsed for non-root paths, involving detecting and parsing adjacency lists before updating the data model, and includes a new test case. However, a medium-severity security issue was identified concerning the logging of untrusted data in the update method, which could expose sensitive information and cause denial-of-service. Additionally, the review includes suggestions to address unreachable code, a potential type-safety issue in the root path update logic, and to refactor a loop into a more idiomatic functional style.

[gemini-code-assist]

The DataModel.update method logs the entire contents object at the WARNING level when a literal list is used as the root data model. This is a medium-severity security issue as it can lead to sensitive information exposure (PII, tokens, etc.) in the application logs. Additionally, string interpolation of large or deeply nested objects can cause performance issues or even a stack overflow due to recursive toString() calls in Dart's collection classes. It is recommended to remove the object from the log message to prevent data leakage and ensure stability.

Suggested change

	genUiLogger.warning(
	'DataModel.update: literal list cannot be used as '
	'root data model: $contents',
	);
	genUiLogger.warning(
	'DataModel.update: literal list cannot be used as '
	'root data model',
	);

[gemini-code-assist]

For improved conciseness and to follow a more functional style, you could consider using the every method on the list. This checks if all items satisfy the conditions for being part of an adjacency list and can make the intent of the code slightly clearer.

  bool _isAdjacencyList(List<Object?> contents) {
    if (contents.isEmpty) return false;
    return contents.every((item) {
      if (item is! Map || !item.containsKey('key')) {
        return false;
      }
      return _a2uiValueKeys.any(item.containsKey);
    });
  }