[Security] Bound validator output while the subprocess runs #2

New Issue

2026-09-08T01:06:33+02:00

zemion commented

2026-09-08 01:06:33 +02:00

Static audit found backend/validation.py uses capture_output=True around line 161 and checks the 2 MiB cap after completion around line 179. Drain stdout/stderr with explicit byte bounds, terminate and reap when exceeded, preserve timeout/cancellation and valid diagnostics. Test noisy/hanging/failing validators in isolated fixtures; never invoke a real external validator on confidential user invoices for tests. Retain the existing output cap and command/argv safety.

Source review and coordinated status: GovOPlaN/govoplan-core#296 .

Static audit found backend/validation.py uses capture_output=True around line 161 and checks the 2 MiB cap after completion around line 179. Drain stdout/stderr with explicit byte bounds, terminate and reap when exceeded, preserve timeout/cancellation and valid diagnostics. Test noisy/hanging/failing validators in isolated fixtures; never invoke a real external validator on confidential user invoices for tests. Retain the existing output cap and command/argv safety. Source review and coordinated status: https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/296 .

zemion referenced this issue from GovOPlaN/govoplan-core

2026-09-08 01:10:36 +02:00

[Security / performance] Workspace review and verified hardening — September 2026 #296

zemion referenced this issue from a commit

2026-09-08 05:39:35 +02:00

fix(xrechnung): bound validator output and report reads

zemion commented

2026-09-08 05:47:47 +02:00

Implemented, verified and pushed — 2026-09-08

Available on remote main in commit b73709c65ac0. This is an unreleased follow-up, not part of the frozen 0.1.45 package composition. No version or tag changed; no runtime, database or live-provider operation was performed.

The runner drains stdout/stderr with one shared, existing 2 MiB budget (including the separator byte), detects overflow during execution, and kills/reaps the direct child on overflow, timeout or cancellation. Diagnostics, command/argv/environment safety, technical-result precedence and fail-closed handoff behavior are preserved. The adjacent report read is now bounded to the existing 16 MiB limit plus one probe byte before interpretation; overflow of runner output skips report reads entirely.

All 30 module tests passed on Python 3.12 and 3.13. Synthetic child-process regressions cover stdout, stderr, combined/exact bounds, noisy and hanging children, cancellation/reaping, error markers, report bounds and failure precedence. Three noisy-runner and four report-read regressions were demonstrated to fail against the previous source. No real validator or confidential invoice was used. Ruff, all 72 manifest checks and the complete workspace focused gate passed; static EN/DE user/admin topics and the module guide are updated.

Closing this bounded-capture issue. POSIX pipes are required; disk quotas, descendant-process isolation and hard process CPU/memory budgets remain separate work, consistent with Core #297. The implementation does not claim complete worker isolation or real-provider acceptance.

## Implemented, verified and pushed — 2026-09-08 Available on remote `main` in [commit `b73709c65ac0`](https://git.add-ideas.de/GovOPlaN/govoplan-xrechnung/commit/b73709c65ac031b6829af08d006e5036757c1a24). This is an **unreleased follow-up**, not part of the frozen 0.1.45 package composition. No version or tag changed; no runtime, database or live-provider operation was performed. The runner drains stdout/stderr with one shared, existing 2 MiB budget (including the separator byte), detects overflow during execution, and kills/reaps the direct child on overflow, timeout or cancellation. Diagnostics, command/argv/environment safety, technical-result precedence and fail-closed handoff behavior are preserved. The adjacent report read is now bounded to the existing 16 MiB limit plus one probe byte before interpretation; overflow of runner output skips report reads entirely. All 30 module tests passed on Python 3.12 and 3.13. Synthetic child-process regressions cover stdout, stderr, combined/exact bounds, noisy and hanging children, cancellation/reaping, error markers, report bounds and failure precedence. Three noisy-runner and four report-read regressions were demonstrated to fail against the previous source. No real validator or confidential invoice was used. Ruff, all 72 manifest checks and the complete workspace focused gate passed; static EN/DE user/admin topics and the module guide are updated. Closing this bounded-capture issue. POSIX pipes are required; disk quotas, descendant-process isolation and hard process CPU/memory budgets remain separate work, consistent with [Core #297](https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/297). The implementation does not claim complete worker isolation or real-provider acceptance.

zemion closed this issue

2026-09-08 05:47:47 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-xrechnung#2