fix(security): [MEDIUM] resolve Denial of Service (DoS) vulnerability in Automaton Builders#177
Conversation
… in Automaton Builders Added a hard limit of 10,000 max states in `AbstractAutomatonBuilder` during manual automaton construction. Exceeding this limit throws an `IllegalStateException` to prevent unbounded memory allocation and state explosion attacks. Existing states can still be modified without triggering the exception. Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
1 participant
Severity: MEDIUM
Vulnerability: Unbounded memory allocation during manual Automaton state construction.
Impact: A malicious actor could exploit this vulnerability to intentionally construct Automata with excessive numbers of states, leading to memory exhaustion and causing a Denial of Service (DoS) attack.
Fix: Added a
MAX_STATESlimit of 10,000 within theAbstractAutomatonBuilder'saddStatemethod to safely prevent State Explosion. Throws anIllegalStateExceptionwhen the limit is breached, while correctly ignoring modifications to existing states.Verification: Run
mvn clean testand observe that all existing builds, formatting, and unit tests continue to pass correctly, successfully preventing the unchecked accumulation of resources.PR created automatically by Jules for task 9717326191698876289 started by @Tugamer89