Prevent Injection in Config Processing

HardPython

Problem

Stripe Radar rules are supplied as JSON-like configuration objects. Implement safely_process_radar_rules to validate a nested rule tree and return a canonical JSON string that can be safely stored and later interpreted as data, not executable syntax. Return None for any invalid configuration.

The accepted root object has exactly version and rules. Each rule has exactly if and action, where action is allow, block, or review. Conditions are recursive expressions:

{"all": [expression, ...]}
{"any": [expression, ...]}
{"not": expression}
{"field": name, "op": operator, "value": value}

Allowed fields are amount, billing_country, card_country, and risk_level. Numeric fields accept numeric values, while country fields accept strings and risk_level accepts one of low, medium, or high. Operators must be compatible with the field type. The in operator accepts a non-empty list of compatible values.

Reject unknown keys, dangerous key names such as __proto__, control characters in strings, non-finite numbers, excessive nesting, and configurations exceeding the stated limits. Canonical output must use sorted keys, compact separators, and JSON escaping.

Constraints

The root object must contain exactly the keys version and rules
version must equal 1
0 <= rules.length <= 100
The expression tree contains at most 1,000 nodes
Expression depth is at most 20
Strings contain at most 128 characters and no control characters
Numeric values must be finite JSON-compatible numbers
Only allowlisted fields, operators, and actions are accepted

Function Signature

def safely_process_radar_rules(config):