fix: begrens het lezen van grafiekdata bij het openen #548

Merged

brenno merged 1 commit from fix/onbegrensde-reads into main

2026-07-22 13:23:36 +00:00

brenno commented

2026-07-22 13:23:34 +00:00

Owner

Summary

Fifth item from #516: the remaining unbounded reads. One fixed, one deliberately left with the reason.

Chart data — fixed

Chart data travels beside the deck, so it arrives from a package, a repository or somebody else's folder. It was read with no size check, and parsing the CSV puts a second copy on top of the first. Opening has no interface to interrupt, which makes it exactly the moment you do not want an unbounded read.

8 MiB, which is generous for any chart a human reads. Over the cap the file gets the same treatment as a missing one: the chart draws empty and the path lands in the warnings. Silently skipping would read as "this chart has no numbers".

Mutation-checked: removing the cap makes the test fail.

The nested CVE zip — not fixed, on purpose

cve_bulk_ingest.dart already streams file-to-file and caps each record (maxRecordBytes). What is missing is a cap on the declared uncompressed size of the inner zip — the zip-bomb axis.

I am not inventing a number for it. The real CVE list is hundreds of megabytes, so a cap picked from intuition either never fires (theatre) or breaks the feature silently for a user who is mid-download. That one needs measuring against a real download, which is not something to do unattended.

Gates

make check green.

Part of #516; four items left, of which audienceBoundary, DocumentSignature and the RFC 3161 chain verification are design decisions rather than fixes.

## Summary Fifth item from #516: the remaining unbounded reads. One fixed, one deliberately left with the reason. ## Chart data — fixed Chart data travels beside the deck, so it arrives from a package, a repository or somebody else's folder. It was read with no size check, and parsing the CSV puts a second copy on top of the first. **Opening has no interface to interrupt**, which makes it exactly the moment you do not want an unbounded read. 8 MiB, which is generous for any chart a human reads. Over the cap the file gets the same treatment as a missing one: the chart draws empty and the path lands in the warnings. Silently skipping would read as "this chart has no numbers". **Mutation-checked:** removing the cap makes the test fail. ## The nested CVE zip — not fixed, on purpose `cve_bulk_ingest.dart` already streams file-to-file and caps each record (`maxRecordBytes`). What is missing is a cap on the *declared uncompressed size* of the inner zip — the zip-bomb axis. I am not inventing a number for it. The real CVE list is hundreds of megabytes, so a cap picked from intuition either never fires (theatre) or breaks the feature silently for a user who is mid-download. That one needs measuring against a real download, which is not something to do unattended. ## Gates `make check` green. Part of #516; four items left, of which `audienceBoundary`, `DocumentSignature` and the RFC 3161 chain verification are design decisions rather than fixes.

brenno added 1 commit

2026-07-22 13:23:35 +00:00

fix(beveiliging): begrens het lezen van grafiekdata bij het openen

CI / Gate (Linux) · Format · Analyze · Coverage (pull_request) Failing after 4s

Details

CI / Web hardening (pull_request) Failing after 4s

Details

CI / Docs links (pull_request) Failing after 4s

Details

CI / Supply-chain (Trivy · advisory) (pull_request) Failing after 5s

Details

CI / Test (macos-latest) (pull_request) Has been cancelled

Details

CI / Test (windows-latest) (pull_request) Has been cancelled

Details

f502150275

Grafiekdata reist naast het deck mee — uit een pakket, een repo of iemands
map — en werd bij het openen onbegrensd ingelezen, met een tweede kopie
bovenop zodra de CSV geparseerd werd. Het openen heeft geen interface om
af te breken, dus dat is precies het moment waarop je dat niet wilt.

8 MiB is ruim voor elke grafiek die een mens leest. Boven de grens krijgt
het bestand dezelfde behandeling als een ontbrekend bestand: de grafiek
tekent leeg en het pad staat in de waarschuwingen. Stil overslaan zou
lezen als "deze grafiek heeft geen cijfers".

De geneste CVE-zip uit hetzelfde issue laat ik staan. Die streamt al van
bestand naar bestand en heeft een grens per record; wat ontbreekt is een
grens op de opgegeven uitgepakte omvang van de binnenste zip. Een getal
daarvoor gok ik niet — de echte CVE-lijst is honderden megabytes en een te
krappe grens breekt de functie stil. Dat hoort gemeten te worden tegen een
echte download.

Getoetst met een mutatie: de grens weghalen laat de test vallen.

Onderdeel van #516.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

brenno merged commit 7f7e7d4cf2 into main

2026-07-22 13:23:36 +00:00

brenno deleted branch fix/onbegrensde-reads

2026-07-22 13:23:36 +00:00

brenno referenced this pull request from a commit

2026-07-22 13:23:37 +00:00

Merge pull request 'fix: begrens het lezen van grafiekdata bij het openen' (#548) from fix/onbegrensde-reads into main

brenno referenced this pull request

2026-07-22 13:44:01 +00:00

[Feature] Document the memory-safety mitigations for the native layer (QA.05) #553

brenno referenced this pull request

2026-07-22 13:45:49 +00:00