Skip to content

fix(parsers): ADR 0004 batch 14 — cpan, cpan_dist_ini, cpan_makefile_pl, conda, conda_meta_json#681

Merged
abraemer merged 1 commit intomainfrom
fix/adr0004-batch14-cpan-cpandistini-cpanmakefile-conda-condameta
Apr 15, 2026
Merged

fix(parsers): ADR 0004 batch 14 — cpan, cpan_dist_ini, cpan_makefile_pl, conda, conda_meta_json#681
abraemer merged 1 commit intomainfrom
fix/adr0004-batch14-cpan-cpandistini-cpanmakefile-conda-condameta

Conversation

@abraemer
Copy link
Copy Markdown
Collaborator

Summary

  • Apply ADR 0004 security compliance fixes to 5 parsers: cpan, cpan_dist_ini, cpan_makefile_pl, conda, conda_meta_json
  • Add DoS protection (file size checks, iteration caps, string truncation), lossy UTF-8 fallback, and .expect() removal per ADR 0004

Changes

Parser File Size Iteration Caps String Truncation UTF-8 .expect()
cpan read_file_to_string multiple sites truncate_field
cpan_dist_ini read_file_to_string 3 sites truncate_field
cpan_makefile_pl read_file_to_string 5 sites truncate_field .expect()→unwrap_or
conda read_file_to_string 3 sites truncate_field
conda_meta_json read_file_to_string 1 site truncate_field

Test Plan

  • cargo check passes
  • cargo clippy --all-targets --all-features — 0 warnings
  • cargo fmt — clean
  • Pre-commit hooks pass

…pl, conda, conda_meta_json

Add DoS protection (file size, iteration caps, string truncation),
lossy UTF-8 fallback, and .expect() removal per ADR 0004.

- cpan: read_file_to_string, iteration caps, truncate_field
- cpan_dist_ini: read_file_to_string, iteration caps, truncate_field
- cpan_makefile_pl: read_file_to_string, iteration caps, truncate_field, .expect()→unwrap_or
- conda: read_file_to_string, iteration caps, truncate_field
- conda_meta_json: read_file_to_string, iteration caps, truncate_field
@abraemer abraemer merged commit 46d365e into main Apr 15, 2026
14 checks passed
@abraemer abraemer deleted the fix/adr0004-batch14-cpan-cpandistini-cpanmakefile-conda-condameta branch April 15, 2026 07:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant