From 8aa4345da8c3cd16bf61908c89bf19830150e4fe Mon Sep 17 00:00:00 2001
From: alex <53851759+alxxjohn@users.noreply.github.com>
Date: Wed, 19 Aug 2026 09:54:48 -0400
Subject: [PATCH 1/2] fix: cap rule stats history reads

---
 .../runner/support/rule_stats_history.go      |  9 ++-------
 tests/support/rule_stats_history_test.go      | 20 +++++++++++++++++++
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/internal/codeguard/runner/support/rule_stats_history.go b/internal/codeguard/runner/support/rule_stats_history.go
index 736a9d4..0773e9b 100644
--- a/internal/codeguard/runner/support/rule_stats_history.go
+++ b/internal/codeguard/runner/support/rule_stats_history.go
@@ -1,11 +1,10 @@
 package support
 
 import (
-	"encoding/json"
-	"os"
 	"strings"
 	"time"
 
+	"github.com/devr-tools/codeguard/internal/codeguard/cachefile"
 	"github.com/devr-tools/codeguard/internal/codeguard/core"
 )
 
@@ -32,12 +31,8 @@ func LoadRuleStatsHistory(path string) []core.RuleStatsHistoryEntry {
 	if strings.TrimSpace(path) == "" {
 		return nil
 	}
-	data, err := os.ReadFile(path) //nolint:gosec // config-supplied rule-stats history cache path
-	if err != nil {
-		return nil
-	}
 	var file ruleStatsHistoryFile
-	if err := json.Unmarshal(data, &file); err != nil || file.Version != ruleStatsHistoryVersion {
+	if !cachefile.Load(path, &file) || file.Version != ruleStatsHistoryVersion {
 		return nil
 	}
 	return file.Entries
diff --git a/tests/support/rule_stats_history_test.go b/tests/support/rule_stats_history_test.go
index 0e3cea2..436a4f2 100644
--- a/tests/support/rule_stats_history_test.go
+++ b/tests/support/rule_stats_history_test.go
@@ -2,6 +2,7 @@ package support_test
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -29,6 +30,25 @@ func TestRuleStatsHistoryPathForBase(t *testing.T) {
 	}
 }
 
+func TestLoadRuleStatsHistoryRejectsOversizedFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "cache.rule-stats-history.json")
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := f.Truncate((32 << 20) + 1); err != nil {
+		_ = f.Close()
+		t.Fatal(err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	if got := runnersupport.LoadRuleStatsHistory(path); len(got) != 0 {
+		t.Fatalf("expected empty history for oversized file, got %#v", got)
+	}
+}
+
 func TestRuleStatsHistoryRoundTripAndCap(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "cache.rule-stats-history.json")
 

From 3aeb20ee2821761171653749714520bdcca9a8bd Mon Sep 17 00:00:00 2001
From: alex <53851759+alxxjohn@users.noreply.github.com>
Date: Wed, 19 Aug 2026 12:59:02 -0400
Subject: [PATCH 2/2] test: import os for oversized rule history fixture

---
 tests/support/rule_stats_history_test.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/support/rule_stats_history_test.go b/tests/support/rule_stats_history_test.go
index 95d62c1..436a4f2 100644
--- a/tests/support/rule_stats_history_test.go
+++ b/tests/support/rule_stats_history_test.go
@@ -2,6 +2,7 @@ package support_test
 
 import (
 	"fmt"
+	"os"
 	"path/filepath"
 	"testing"