security: bound archive member enumeration before materialization - #70
Draft
seonghobae wants to merge 1 commit into
Draft
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Contributor
Author
|
@opencode-agent Implement the bounded GREEN repair on exact current RED head The immutable RED commit is valid. Local execution against the exact current generator failed only the two new focused regressions: the overmember wheel reached Modify only:
Required bounded implementation:
Run the two focused RED tests first, then all new boundary tests, the full Python 3.10–3.13 suite, Ruff, compileall, public-docstring checks, 100% production statement and branch coverage, product-guard self-test, wheel/sdist package acceptance, and applicable SAST/Security Scan on the resulting exact head. Keep the PR draft. Stop without writing if the head differs from |
Contributor
Author
|
@opencode-agent The earlier implementation request remains authoritative. To avoid any ambiguity and connector-size truncation, apply the exact verified four-file patch below on exact current RED head Patch contract:
Procedure: copy the base64 payload without whitespace to a root-only temporary file outside the repository, decode base64, verify the gzip SHA-256, decompress, verify decoded size and SHA-256, run |
Contributor
Author
|
@opencode-agent Apply and verify the exact patch payload in comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test-first parser-resource hardening
Progresses #69 as a bounded draft stack on PR #68.
Exact tree binding
224e6d253a7957e981515ec66260fb1c2cf84a31.fb4ccefae3899c617bf969a3c93be3924177b23c.Confirmed gap
The current direct generator enforces the 256 MiB compressed-byte ceiling before and during parser reads, but the archive-member limit is evaluated after parser materialization:
zipfile.ZipFile(stream)builds the full central-directoryZipInfotable beforeinfolist()reaches_check_archive_names(...);tarfile.getmembers()constructs the complete member list before_check_archive_names(...).A bounded compressed input can therefore still amplify into excessive object allocation or gzip/tar processing before the repository's intended 10,000-member rejection.
Exact RED evidence
The current test-only commit adds exactly one new test module and no production, documentation, workflow, dependency, credential, permission, release, publication, signing, attestation, tag, ref, or network change.
CI run
31104663109is valid RED evidence on exact headfb4ccefae3899c617bf969a3c93be3924177b23c:2 failed, 763 passed;ZipFileconstructor before the member bound;TarFile.getmembers()before the member bound.The intended GREEN implementation must satisfy issue #69 test-first, add finite ZIP central-directory and streamed tar/gzip expansion controls, preserve all existing trust boundaries, and complete exact-head CI/security/review gates.
Remaining gates
Keep this PR draft and intentionally RED. Do not merge, mark ready, enable auto-merge, release, publish, rebase, retarget, force-update, or infer success from queued checks. After GREEN it still requires Python 3.10–3.13, complete tests, Ruff, compileall, public-docstring checks, 100% production statement/branch coverage, package acceptance, applicable SAST/Security Scan, completed exact-head automated review, independent non-author approval, branch protection, and every repository policy gate.