[Security follow-up] Isolate untrusted parsing and reference execution with hard resource limits #297

New Issue

2026-09-08T01:06:01+02:00

zemion commented

2026-09-08 01:06:01 +02:00

Coordinate process-level memory/CPU/output limits for uploaded archives/spreadsheets, rendering and reference Dataflow execution. The current audit implements bounded XLSX coordinates, incremental template/TAR checks and LPAD/RPAD preallocation checks; these are not complete worker isolation. Remaining examples: regex operations can run beyond cooperative before-operator deadlines; aggregate row allocation may precede final size checks; TAR extension headers are decoded by tarfile before regular-member limits. Preserve configurable functional limits, cancellation/progress and structured diagnostics; never run hostile fixtures against a live instance. Add isolated process-budget regressions and production-like concurrency/load verification. Coordinate owning module slices instead of importing their internals into Core.

Source review and coordinated status: #296 .

Coordinate process-level memory/CPU/output limits for uploaded archives/spreadsheets, rendering and reference Dataflow execution. The current audit implements bounded XLSX coordinates, incremental template/TAR checks and LPAD/RPAD preallocation checks; these are not complete worker isolation. Remaining examples: regex operations can run beyond cooperative before-operator deadlines; aggregate row allocation may precede final size checks; TAR extension headers are decoded by tarfile before regular-member limits. Preserve configurable functional limits, cancellation/progress and structured diagnostics; never run hostile fixtures against a live instance. Add isolated process-budget regressions and production-like concurrency/load verification. Coordinate owning module slices instead of importing their internals into Core. Source review and coordinated status: https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/296 .

zemion referenced this issue

2026-09-08 01:10:36 +02:00

[Security / performance] Workspace review and verified hardening — September 2026 #296

zemion referenced this issue from GovOPlaN/govoplan-files

2026-09-08 05:03:44 +02:00

[Security] Bound TAR inspection before payload traversal #46

zemion referenced this issue from GovOPlaN/govoplan-dataflow

2026-09-08 05:06:54 +02:00

[Security] Bound padding allocations using the existing preview budget #22

zemion referenced this issue from GovOPlaN/govoplan-xrechnung

2026-09-08 05:47:47 +02:00

[Security] Bound validator output while the subprocess runs #2

zemion commented

2026-09-08 08:09:36 +02:00

The shared resource-boundary slice is implemented and published in govoplan-core dc1f244f1745, with owning integrations in Connectors, Templates, Files and Dataflow.

Disposable children enforce wall/CPU/address-space and input/output limits, bounded stderr, non-queuing admission and descendant cleanup. A bounded typed codec avoids arbitrary deserialization. Parent-side authorization, provider credentials, sessions and persistence remain in the owning module. Hostile input has no inline fallback. Files extraction uses validated private staging and event-driven per-member acknowledgement rather than a fixed polling delay.

Real-child regressions cover catastrophic regex, aggregate memory, TAR metadata, malformed/noisy transport, cancellation, descendant reaping and persistence cleanup. Mixed-owner admission completed nine children, rejected six overlaps and recovered every slot. The full focused run passed all 63 production build permutations and 230 browser cases; all 72 manifests passed.

Keeping this open for its explicit production-like concurrency/load acceptance. Local fixtures do not certify the target API/worker topology: Linux/cgroup memory, process counts, disk quotas, cancellation and legitimate large workloads still need target evidence. Admission is per process, not fleet-wide, and this is not an arbitrary-code/filesystem/network sandbox. A newly versioned release must raise affected consumer Core minimums before package publication.

Full implementation, verification and remaining adoption gates. Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment.

The shared resource-boundary slice is implemented and published in [govoplan-core dc1f244f1745](https://git.add-ideas.de/GovOPlaN/govoplan-core/commit/dc1f244f1745d424844ec3c86a6fb1948817b1c5), with owning integrations in Connectors, Templates, Files and Dataflow. Disposable children enforce wall/CPU/address-space and input/output limits, bounded stderr, non-queuing admission and descendant cleanup. A bounded typed codec avoids arbitrary deserialization. Parent-side authorization, provider credentials, sessions and persistence remain in the owning module. Hostile input has no inline fallback. Files extraction uses validated private staging and event-driven per-member acknowledgement rather than a fixed polling delay. Real-child regressions cover catastrophic regex, aggregate memory, TAR metadata, malformed/noisy transport, cancellation, descendant reaping and persistence cleanup. Mixed-owner admission completed nine children, rejected six overlaps and recovered every slot. The full focused run passed all 63 production build permutations and 230 browser cases; all 72 manifests passed. Keeping this open for its explicit production-like concurrency/load acceptance. Local fixtures do not certify the target API/worker topology: Linux/cgroup memory, process counts, disk quotas, cancellation and legitimate large workloads still need target evidence. Admission is per process, not fleet-wide, and this is not an arbitrary-code/filesystem/network sandbox. A newly versioned release must raise affected consumer Core minimums before package publication. [Full implementation, verification and remaining adoption gates](https://git.add-ideas.de/GovOPlaN/govoplan/src/commit/58d320d9b34a618aab6ce0b9e48daf943961af66/docs/security/SECURITY_FOLLOWUP_2026-09-08.md). Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment.

zemion referenced this issue

2026-09-08 08:09:37 +02:00

[Security / performance] Workspace review and verified hardening — September 2026 #296

zemion referenced this issue

2026-09-08 12:43:05 +02:00

Verify integrity release against real mail and storage providers #299

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#297