HSTS: cap the list at 1,000 entries

[bagder]

Avoid never-ending growth.

When adding more entries, it now deletes the first entry in the list, which is the oldest added entry still held in memory. I decided to avoid a Least Recently Used concept as I suspect with a list with this many entries most entries have not been used, and we don't save the timestamp of recent use anyway.

The net effect might (no matter what) be that the removed entry might feel a bit "random" in the eyes of the user.

Verify with test 1674

Ref #21183

[Copilot]

Pull request overview

This PR introduces a hard cap on the in-memory HSTS cache size to prevent unbounded growth, and adds a new unit/integration test to verify the cap behavior when loading from a file.

Changes:

• Add MAX_HSTS_ENTRIES (1,000) and enforce it by evicting the oldest entry on insert.
• Add unit test unit1674 and test definition test1674 to validate the cache is capped at 1,000 entries when loading more.
• Register the new test in the unit and data makefiles.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
lib/hsts.h	Introduces MAX_HSTS_ENTRIES to define the HSTS cache cap.
lib/hsts.c	Adds capped append helper that evicts the oldest entry before appending when at limit.
tests/unit/unit1674.c	New unit test that renders an over-limit HSTS file, loads it, and prints resulting entry count.
tests/unit/Makefile.inc	Registers unit1674.c in the unit test build list.
tests/data/test1674	Adds a runtests.pl test case that validates stdout reports 1,000 entries.
tests/data/Makefile.am	Registers test1674 in the test data list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: Prevent unbounded growth of the in-memory HSTS cache by enforcing a hard cap.

Changes:

• Add MAX_HSTS_ENTRIES (1000) and a helper that evicts the oldest entry before appending when the cache is full
• Route HSTS entry creation through the new capped-append path
• Add unit test 1674 that generates an HSTS file with >1000 hosts and verifies the cache is capped at 1000 entries

Technical Notes: Eviction is FIFO by insertion order (not LRU).

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 3 suggestions posted.

Comment augment review to trigger a new review at any time.