Repository navigation
fix(security): JS check memory budget gaps and regexp time limit, Discord link re-authentication, invitation cap - #735
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e flattening against the memory budget Closes the four paths of security finding AB1 (spec 2026-11-01-01): - typed arrays built from an array-like read its length once (pinned behind a Proxy), so a length getter can no longer answer 0 to the charge and a huge value to the allocation; - concat, slice, splice and filter are charged for their result; flat and flatMap are rewritten in Go and charge each element before appending it; - String.prototype.split is charged per part, replace/replaceAll for their output (the replacement goes to goja as a Go function that measures and charges each expansion, or is charged up front for a string pattern); - Function.prototype.apply, Reflect.apply and Reflect.construct check an array-like argument list; - stopgap for the + rope: a rope over 64 KiB is charged when a String.prototype or RegExp method, a binding (arguments scanned deeply) or the result export would flatten it. Other flatten paths (s[0], ==, Number(s)) still need process isolation, a follow-up. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ne call allocate GBs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #735 +/- ##
==========================================
+ Coverage 89.77% 89.79% +0.02%
==========================================
Files 1306 1310 +4
Lines 132987 133514 +527
==========================================
+ Hits 119389 119891 +502
- Misses 13589 13614 +25
Partials 9 9
🚀 New features to boost your workflow:
|
goja runs patterns with lookarounds or backreferences on regexp2, whose default match timeout is forever, and vm.Interrupt cannot reach a running match. A nested quantifier on a non-matching input pinned a core per run. regexp2.DefaultMatchTimeout is now 2 s process-wide; a timed-out match is reported as ERROR "regular expression took too long" without echoing the input. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ktrack forever Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…l the owner link-start now asks for the current password (or a recent sign-in for a passwordless account), like a new TOTP or passkey, and a successful link enqueues a discord-linked.html security notice (en, fr, de, es). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…uthentication and sends no notice Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…call in e2e Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…uthentication and sends no notice Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…h keyed lookups Invitations: 50 live per org (or the seat cap when lower), 409 TOO_MANY_INVITATIONS. Sign-in finds pending invitations through invite_email:<hash>:<org>. Registrations: per-IP slots and token lookup are keyed (registration_ip:, registration_token:). Invitations and registrations pending before the upgrade have no new keys: invitees use their link, sign-ups re-submit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…tions of the instance, and outstanding invitations are uncapped Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…tions of the instance, and outstanding invitations are uncapped Cap test asserts no email job on refusal (with positive control) and uses a real past expires_at. Migration decision (no fallback) recorded in the spec. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
They copy up to the whole budget before being refused (0.3-0.5s of CPU), so among ~50 parallel subtests on a loaded runner they hit the 2s script timeout and the 1s bound. Assertions unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ot a fixed second The refusal is exact and comes before the refused allocation, but goja has really copied what the budget still allowed (up to ~2M slots) by then, which took 1.7s on a loaded runner. Time the permitted part of each script as a baseline and require the refusal within 3x of it plus a margin. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The test revoked list.Data[0], which is ordered by random token hash, so about 1 run in 50 it revoked invites[1] (the one it then expires), leaving the org at the cap. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.