mirror of
https://github.com/storytold/cadcraft.git
synced 2026-10-24 10:56:51 -06:00
Dylan M. Taylorandskylartaylor
953a6b3b01
* security: bound Lisp callbacks, native comparisons, and local file reads (CWE-400, CWE-407) The command and scripting engine had several unbounded paths a supplied LISP routine or a selected path could exploit to monopolise the thread or exhaust memory: - `call_sync` ran synchronous callbacks (vl-sort comparators, vl-remove-if predicates, …) with `u64::MAX` fuel, so a constant-memory infinite loop never yielded and bypassed the blocking execution cap. It now drives the callback in bounded slices and aborts with an error past a hard step cap (row 2). - `wcmatch`/`glob` explored `*` placements with only a recursion-depth guard, and `equal` re-traversed shared cons subtrees. Both now charge every step against a shared work budget and stop when it is exhausted (row 33). - `setvar` converted a LISP value to JSON unboundedly, so a shared cons DAG expanded into gigabytes of owned arrays. Conversion is now depth- and element-bounded and rejects over-budget values with a LISP error (row 39). - OPEN/LOAD/APPLOAD (`read_text_file`), SCRIPT, and native open (`read_file`, `run_open`) buffered a path with `std::fs::read`, so an endless device exhausted memory before any size check. Reads now go through a new `capped_read` helper that rejects non-regular files and caps bytes (rows 21, 34). New tests cover the callback loop, the oversized setvar structure, and the capped reader. Addresses findings rows 2, 21, 33, 34, 39. * fix: bound native Lisp scans and nonblocking file reads * fix: enforce callback fuel before each execution slice --------- Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>