mirror of
https://github.com/storytold/cadcraft.git
synced 2026-10-24 10:56:51 -06:00
Dylan M. Taylorandskylartaylor
916be26ed3
* security: bound constraint-engine work and allocation (CWE-400/407) The constraint engine let imported geometry or settings cause disproportionate CPU/memory work on the synchronous analysis thread: - Auto-constraint inference scanned the whole caller-supplied type list for every geometric candidate. Resolve the allowed type names into a set once and use O(1) membership per candidate (row 46). - Rigid-point sampling stopped after collecting points but kept traversing block members that contribute none (Text, Ray, …), repeated for every Insert. Count every examined member against a bounded budget (row 47). - Control-mode residual evaluation cloned the whole retained spline, including excess imported weights, for each free parameter. Drop weights that do not match the control-point count before retaining the template (row 45). - The DOF analysis budget estimated only matrix-rank work, ignoring the spline reconstruction each tangent residual performs during numerical differentiation. Add a residual-evaluation budget (rows × free × per-residual cost, including a spline-reconstruction term) enforced before building the Jacobian (row 43). All constraints tests pass; clippy adds no new warnings. Addresses findings rows 43, 45, 46, 47. * fix: budget constraint work without changing spline weights --------- Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>