fix(security): [security improvement] Add state limit to builder to prevent DoS#153
fix(security): [security improvement] Add state limit to builder to prevent DoS#153Tugamer89 wants to merge 1 commit into
Conversation
Adds a MAX_STATES limit of 10000 to AbstractAutomatonBuilder to prevent Memory Exhaustion and Algorithmic Complexity Denial of Service (DoS) attacks when manually constructing automata via the builder API. Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
1 participant
Severity: HIGH
Vulnerability: Denial of Service (DoS) via algorithmic complexity and memory exhaustion when manually building automata with an excessive number of states.
Impact: Attackers or malformed inputs could theoretically cause the application to run out of memory or consume excessive CPU time during minimization/conversion by manually constructing an extremely large automaton via the builder API.
Fix: Added a hard
MAX_STATESlimit (10000) toAbstractAutomatonBuilder.addStatethat matches the existingMAX_DFA_STATESinternal protection limit. If the limit is exceeded, anIllegalStateExceptionis thrown safely.Verification: Ran automated tests (
mvn test) to ensure functionality remains unaffected and tested manually by attempting to build an automaton with > 10000 states, which now safely rejects it.PR created automatically by Jules for task 5799416167655772921 started by @Tugamer89