fix(security): [CRITICAL] resolve Denial of Service (DoS) via memory exhaustion in manual automaton construction#154
Conversation
…exhaustion in manual automaton construction Added a MAX_STATES limit to the AbstractAutomatonBuilder to prevent unconstrained state allocations during manual automaton construction. This hard limit prevents Denial of Service (DoS) attacks caused by deliberate memory exhaustion or logic errors in user-provided automaton definitions. Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
1 participant
Severity: CRITICAL
Vulnerability: Denial of Service (DoS) vulnerability due to unconstrained state allocation in AbstractAutomatonBuilder, leading to memory exhaustion (OOM).
Impact: An attacker could construct an automaton with an extremely large number of states, consuming all available JVM memory, crashing the application.
Fix: Introduced a constant
MAX_STATES = 10000inAbstractAutomatonBuilderand an explicit check insideaddState()to limit the total number of states that can be allocated for any single automaton during manual construction. Exceeding this limit immediately throws anIllegalStateException.Verification: Verified by creating a test that attempts to add > 10,000 states and checking that
IllegalStateExceptionis correctly thrown, and by confirming existing unit tests continue to pass correctly.PR created automatically by Jules for task 5785750246689795399 started by @Tugamer89