fix: validate __type field before accessing in fromJson (#1009)

Co-authored-by: ahuo <[email protected]>

Author: ahuo1

src/json_export.cpp

@@ -112,9 +112,20 @@ JsonExporter::ExpectedEntry JsonExporter::fromJson(const nlohmann::json& source)
     }
   }
 
-  if(!source.contains("__type") && !source.is_array())
+  if(source.is_array())
   {
-    return nonstd::make_unexpected("Missing field '__type'");
+    if(source.empty())
+      return nonstd::make_unexpected("Missing field '__type'");
+    const auto& first = source[0];
+    if(!first.is_object() || !first.contains("__type"))
+      return nonstd::make_unexpected("Missing field '__type'");
+    if(!first["__type"].is_string())
+      return nonstd::make_unexpected("Invalid '__type' (must be string)");
+  }
+  else
+  {
+    if(!source.is_object() || !source.contains("__type") || !source["__type"].is_string())
+      return nonstd::make_unexpected("Missing field '__type'");
   }
 
   auto& from_converters =