From bb589d44f822cf11dd51f00a39f8836b35298de8 Mon Sep 17 00:00:00 2001
From: NotEvil <notevil@noreply.com>
Date: Tue, 14 Apr 2026 02:27:59 +0200
Subject: [PATCH] fix(D-01): warn on non-object component config, deep-copy
 configs (RISK-001, RISK-002)

- Deep-copy JsonObject configs via deepCopy() before storing in the
  definition to prevent external mutation of the parsed JSON tree
- Log a warning when a component config value is not a JsonObject,
  making misconfigured JSON easier to diagnose
---
 .../bondage/datadriven/DataDrivenItemParser.java   | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/main/java/com/tiedup/remake/v2/bondage/datadriven/DataDrivenItemParser.java b/src/main/java/com/tiedup/remake/v2/bondage/datadriven/DataDrivenItemParser.java
index f0da6eb..221b2ae 100644
--- a/src/main/java/com/tiedup/remake/v2/bondage/datadriven/DataDrivenItemParser.java
+++ b/src/main/java/com/tiedup/remake/v2/bondage/datadriven/DataDrivenItemParser.java
@@ -279,9 +279,17 @@ public final class DataDrivenItemParser {
                     entry.getKey()
                 );
                 if (compType != null) {
-                    JsonObject config = entry.getValue().isJsonObject()
-                        ? entry.getValue().getAsJsonObject()
-                        : new JsonObject();
+                    JsonObject config;
+                    if (entry.getValue().isJsonObject()) {
+                        config = entry.getValue().getAsJsonObject().deepCopy();
+                    } else {
+                        LOGGER.warn(
+                            "[DataDrivenItemParser] Component '{}' in item '{}' has non-object config, using defaults",
+                            entry.getKey(),
+                            fileId
+                        );
+                        config = new JsonObject();
+                    }
                     componentConfigs.put(compType, config);
                 } else {
                     LOGGER.warn(