fix: 5 critical/high-priority bugs (auth bypass, relay failures, unbounded recursion, context growth) (#1083)

* fix: address 5 critical and high-priority bugs from issue tracker - #1033: reject webhook requests when secret is cleared at runtime via update_secret(None), preventing auth bypass through SIGHUP hot-swap - #908: reset consecutive_failures counter on successful SSE stream reconnection in relay channel, so circuit breaker counts truly consecutive failures - #975: add depth limit (16) to validate_tool_schema() to prevent stack overflow on deeply nested schemas - #974: add depth limit (8) to resolve_nested() to prevent stack overflow on deeply nested capabilities wrappers - #826: truncate oversized tool outputs (>8KB) in routine lightweight loop to prevent unbounded context growth across iterations Each fix includes a regression test. Closes #1033, #908, #975, #974, #826 Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: 5 more high-priority bugs (routine cache, job signals, input limits) - #1077: recompute next_fire_at when re-enabling cron routines via web toggle, mirroring CLI behavior so cron ticker picks them up - #1076: refresh event trigger cache after web toggle/delete operations so event/system_event routines reflect changes immediately - #892: remove Stuck from check_signals() stop-states in JobDelegate since Stuck is recoverable (Stuck -> InProgress via self-repair) - #976: truncate oversized description strings in CapabilitiesFile to 4KB to prevent memory abuse from malicious capabilities files - #977: drop oversized parameters schema JSON (>64KB) in CapabilitiesFile to prevent unbounded memory growth Each fix includes regression tests where applicable. Closes #1077, #1076, #892, #976, #977 Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: prevent ReDoS in event trigger regex patterns - #825: use RegexBuilder with 64KB size limit when compiling user-supplied event trigger patterns, both at creation time (routine tool) and at cache refresh (routine engine) Note: Rust's regex crate already guarantees O(n) matching, so the size limit prevents excessive memory use during compilation rather than catastrophic backtracking at match time. Closes #825 Co-Authored-By: Claude Opus 4.6 <[email protected]> * Harden HTTP SSRF IP filtering * Apply rustfmt after staging merge --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
2026-08-26 23:50:17 +00:00 · 2026-03-13 16:04:55 +00:00
parent 1e00b1fed5
commit e805ec61aa
9 changed files with 277 additions and 37 deletions
@@ -214,6 +214,7 @@ fn is_disallowed_ipv4(v4: &Ipv4Addr) -> bool {
        || v4.is_multicast()
        || v4.is_unspecified()
        || *v4 == Ipv4Addr::new(169, 254, 169, 254)
+        || (v4.octets()[0] == 100 && (v4.octets()[1] & 0xC0) == 64)
 }

 fn is_disallowed_ip(ip: &IpAddr) -> bool {
@@ -913,6 +914,8 @@ mod tests {
        assert!(is_disallowed_ip(&IpAddr::V4(Ipv4Addr::new(
            169, 254, 169, 254
        ))));
+        // Carrier-grade NAT
+        assert!(is_disallowed_ip(&IpAddr::V4(Ipv4Addr::new(100, 64, 0, 1))));
        // Public
        assert!(!is_disallowed_ip(&IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8))));
    }
@@ -199,9 +199,13 @@ impl Tool for RoutineCreateTool {
                            "event trigger requires 'event_pattern'".to_string(),
                        )
                    })?;
-                // Validate regex
-                regex::Regex::new(pattern)
-                    .map_err(|e| ToolError::InvalidParameters(format!("invalid regex: {e}")))?;
+                // Validate regex with size limit to prevent ReDoS (issue #825)
+                regex::RegexBuilder::new(pattern)
+                    .size_limit(64 * 1024)
+                    .build()
+                    .map_err(|e| {
+                        ToolError::InvalidParameters(format!("invalid or too complex regex: {e}"))
+                    })?;
                let channel = params
                    .get("event_channel")
                    .and_then(|v| v.as_str())
@@ -430,9 +430,24 @@ pub fn redact_params(params: &serde_json::Value, sensitive: &[&str]) -> serde_js
 /// Properties without a `"type"` field are allowed (freeform/any-type).
 /// This is an intentional pattern used by tools like `json` and `http` for
 /// OpenAI compatibility, since union types with arrays require `items`.
+/// Maximum nesting depth for tool schema validation to prevent stack overflow
+/// on maliciously crafted schemas.
+const MAX_SCHEMA_DEPTH: usize = 16;
+
 pub fn validate_tool_schema(schema: &serde_json::Value, path: &str) -> Vec<String> {
+    validate_tool_schema_inner(schema, path, 0)
+}
+
+fn validate_tool_schema_inner(schema: &serde_json::Value, path: &str, depth: usize) -> Vec<String> {
    let mut errors = Vec::new();

+    if depth > MAX_SCHEMA_DEPTH {
+        errors.push(format!(
+            "{path}: schema nesting exceeds maximum depth of {MAX_SCHEMA_DEPTH}"
+        ));
+        return errors;
+    }
+
    // Rule 1: must have "type": "object" at this level
    match schema.get("type").and_then(|t| t.as_str()) {
        Some("object") => {}
@@ -474,14 +489,17 @@ pub fn validate_tool_schema(schema: &serde_json::Value, path: &str) -> Vec<Strin
        if let Some(prop_type) = prop.get("type").and_then(|t| t.as_str()) {
            match prop_type {
                "object" => {
-                    errors.extend(validate_tool_schema(prop, &prop_path));
+                    errors.extend(validate_tool_schema_inner(prop, &prop_path, depth + 1));
                }
                "array" => {
                    if let Some(items) = prop.get("items") {
                        // If items is an object type, recurse
                        if items.get("type").and_then(|t| t.as_str()) == Some("object") {
-                            errors
-                                .extend(validate_tool_schema(items, &format!("{prop_path}.items")));
+                            errors.extend(validate_tool_schema_inner(
+                                items,
+                                &format!("{prop_path}.items"),
+                                depth + 1,
+                            ));
                        }
                    } else {
                        errors.push(format!("{prop_path}: array property missing \"items\""));
@@ -810,6 +828,33 @@ mod tests {
        assert!(errors[0].contains("\"missing_field\""));
    }

+    /// Regression test for issue #975: deeply nested schemas must not cause
+    /// stack overflow. The validator should stop at MAX_SCHEMA_DEPTH and
+    /// report an error instead of recursing infinitely.
+    #[test]
+    fn test_validate_schema_depth_limit() {
+        // Build a schema nested 20 levels deep (exceeds MAX_SCHEMA_DEPTH=16)
+        let mut schema = serde_json::json!({
+            "type": "object",
+            "properties": {
+                "leaf": { "type": "string" }
+            }
+        });
+        for _ in 0..20 {
+            schema = serde_json::json!({
+                "type": "object",
+                "properties": {
+                    "nested": schema
+                }
+            });
+        }
+        let errors = validate_tool_schema(&schema, "test");
+        assert!(
+            errors.iter().any(|e| e.contains("maximum depth")),
+            "expected depth limit error, got: {errors:?}"
+        );
+    }
+
    #[test]
    fn test_approval_context_autonomous_allows_unless_auto_approved() {
        let ctx = ApprovalContext::autonomous();
@@ -101,24 +101,75 @@ pub struct CapabilitiesFile {
    pub capabilities: Option<Box<CapabilitiesFile>>,
 }

+/// Maximum length for the description field to prevent memory abuse.
+const MAX_DESCRIPTION_CHARS: usize = 4096;
+/// Maximum serialized size of the parameters schema JSON.
+const MAX_PARAMETERS_SCHEMA_BYTES: usize = 64 * 1024;
+
 impl CapabilitiesFile {
    /// Parse from JSON string.
    pub fn from_json(json: &str) -> Result<Self, serde_json::Error> {
-        serde_json::from_str::<Self>(json).map(Self::resolve_nested)
+        let mut caps = serde_json::from_str::<Self>(json).map(Self::resolve_nested)?;
+        caps.enforce_limits();
+        Ok(caps)
    }

    /// Parse from JSON bytes.
    pub fn from_bytes(bytes: &[u8]) -> Result<Self, serde_json::Error> {
-        serde_json::from_slice::<Self>(bytes).map(Self::resolve_nested)
+        let mut caps = serde_json::from_slice::<Self>(bytes).map(Self::resolve_nested)?;
+        caps.enforce_limits();
+        Ok(caps)
+    }
+
+    /// Truncate oversized fields to prevent unbounded memory usage.
+    fn enforce_limits(&mut self) {
+        // Truncate oversized description (issue #976)
+        if let Some(ref desc) = self.description
+            && desc.len() > MAX_DESCRIPTION_CHARS
+        {
+            let truncated = &desc[..desc.floor_char_boundary(MAX_DESCRIPTION_CHARS)];
+            tracing::warn!(
+                "Capabilities description truncated from {} to {} chars",
+                desc.len(),
+                MAX_DESCRIPTION_CHARS,
+            );
+            self.description = Some(truncated.to_string());
+        }
+        // Drop oversized parameters schema (issue #977)
+        if let Some(ref params) = self.parameters {
+            let size = params.to_string().len();
+            if size > MAX_PARAMETERS_SCHEMA_BYTES {
+                tracing::warn!(
+                    "Capabilities parameters schema dropped ({} bytes exceeds {} limit)",
+                    size,
+                    MAX_PARAMETERS_SCHEMA_BYTES,
+                );
+                self.parameters = None;
+            }
+        }
    }

    /// Merge nested `capabilities` wrapper into top-level fields.
    ///
    /// Channel-level JSON nests tool capabilities under `"capabilities"`.
    /// This promotes the inner fields so callers can access them uniformly.
-    fn resolve_nested(mut self) -> Self {
+    /// Maximum nesting depth for capabilities resolution.
+    const MAX_NESTED_DEPTH: usize = 8;
+
+    fn resolve_nested(self) -> Self {
+        self.resolve_nested_inner(0)
+    }
+
+    fn resolve_nested_inner(mut self, depth: usize) -> Self {
+        if depth > Self::MAX_NESTED_DEPTH {
+            tracing::warn!(
+                "Capabilities nesting exceeds maximum depth of {}, stopping resolution",
+                Self::MAX_NESTED_DEPTH
+            );
+            return self;
+        }
        if let Some(inner) = self.capabilities.take() {
-            let inner = inner.resolve_nested();
+            let inner = inner.resolve_nested_inner(depth + 1);
            self.description = self.description.or(inner.description);
            self.parameters = self.parameters.or(inner.parameters);
            self.http = self.http.or(inner.http);
@@ -1383,4 +1434,63 @@ mod tests {
            "Outer description should take precedence over inner"
        );
    }
+
+    /// Regression test for issue #974: deeply nested capabilities wrappers
+    /// must not cause stack overflow. resolve_nested should stop at
+    /// MAX_NESTED_DEPTH and return gracefully.
+    #[test]
+    fn test_resolve_nested_depth_limit() {
+        // Build a capabilities file nested beyond MAX_NESTED_DEPTH (8).
+        // The description is at the innermost level which is beyond the limit,
+        // so it won't be resolved — the key assertion is no stack overflow.
+        let mut json = r#"{ "description": "leaf" }"#.to_string();
+        for _ in 0..20 {
+            json = format!(r#"{{ "capabilities": {json} }}"#);
+        }
+        // Should not stack overflow — this is the primary assertion.
+        let _caps = CapabilitiesFile::from_json(&json).unwrap();
+    }
+
+    /// Regression test for issue #976: oversized description strings are truncated.
+    #[test]
+    fn test_description_truncated_at_limit() {
+        let long_desc = "x".repeat(10_000);
+        let json = format!(r#"{{ "description": "{long_desc}" }}"#);
+        let caps = CapabilitiesFile::from_json(&json).unwrap();
+        let desc = caps.description.unwrap();
+        assert!(
+            desc.len() <= super::MAX_DESCRIPTION_CHARS + 50, // allow for minor overhead
+            "description should be truncated to ~{} chars, got {}",
+            super::MAX_DESCRIPTION_CHARS,
+            desc.len()
+        );
+    }
+
+    /// Regression test for issue #977: oversized parameters schema is dropped.
+    #[test]
+    fn test_oversized_parameters_schema_dropped() {
+        // Build a parameters schema larger than MAX_PARAMETERS_SCHEMA_BYTES
+        let mut properties = serde_json::Map::new();
+        for i in 0..2000 {
+            properties.insert(
+                format!("field_{i}"),
+                serde_json::json!({
+                    "type": "string",
+                    "description": "x".repeat(50)
+                }),
+            );
+        }
+        let schema = serde_json::json!({
+            "type": "object",
+            "properties": properties,
+        });
+        let json = serde_json::json!({
+            "parameters": schema,
+        });
+        let caps = CapabilitiesFile::from_json(&json.to_string()).unwrap();
+        assert!(
+            caps.parameters.is_none(),
+            "oversized parameters schema should be dropped"
+        );
+    }
 }