security: harden dynamic pipeline source resolvers#96
Merged
Conversation
Replace unbounded `response.text()` with chunked `read_body_capped()` that enforces a configurable maximum body size (default 10 MB). Also checks Content-Length early when the header is present. Adds shared constants `MAX_SOURCE_RESPONSE_BYTES` and `MIN_REFRESH_INTERVAL` to the sources module, a new `ResourceLimit` variant to `SourceErrorKind`, and handles it in the instrumented resolver's metrics match.
Wrap child process I/O in `tokio::time::timeout` with a configurable deadline (default 30s, forwarded from `DynamicSource.timeout`). Read stdout incrementally and kill the child if it exceeds the 10 MB cap. Stderr is capped at 64 KB for diagnostic messages. Updates existing integration tests for the new timeout parameter.
Check payload length against MAX_SOURCE_RESPONSE_BYTES before parsing in both `resolve_nats_initial` and `parse_nats_message`. Rejects oversized messages with a ResourceLimit error.
Prevent hot CPU loops from sub-second refresh intervals by clamping to MIN_REFRESH_INTERVAL (1s). Logs a warning when the configured value is below the floor so operators know the effective interval.
Cover command execution timeout (kills child on deadline), command stdout size cap (ResourceLimit on overflow), and NATS payload size rejection/acceptance. Makes resolve_command_with_limit public so integration tests can exercise configurable limits.
The `timeout` command requires an interactive console and exits immediately when stdout is piped. Use `Start-Sleep` via powershell instead, which blocks reliably in non-interactive contexts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DynamicSource.timeout) and 10 MB stdout cap to command source resolver, killing the child on overflowResourceLimiterror variant toSourceErrorKindand handle it in the instrumented resolver metricsTest plan
cargo clippy --workspace --all-targets --all-features -- -D warningspassescargo fmt --all -- --checkpassestimeoutparameter