Skip to content

Prevent huge timeout literals from stalling reliability scans - #150

Merged
alxxjohn merged 1 commit into
mainfrom
alexj/propose-fix-for-denial-of-service-vulnerability
Aug 19, 2026
Merged

Prevent huge timeout literals from stalling reliability scans#150
alxxjohn merged 1 commit into
mainfrom
alexj/propose-fix-for-denial-of-service-vulnerability

Conversation

@alxxjohn

Copy link
Copy Markdown
Contributor

Motivation

  • Avoid unbounded math/big.Int parsing of repository-controlled integer literals used to detect zero http.Client.Timeout, which can be maliciously large and cause CPU denial-of-service during scanning.
  • Preserve the reliability check semantics (detect zero timeouts) while eliminating the expensive arbitrary-precision conversion on untrusted source text.

Description

  • Replace the big.Int parse in isZeroDuration with a lexical check via a new helper isZeroIntegerLiteral, and remove the math/big dependency from internal/codeguard/checks/reliability/reliability_go_helpers.go.
  • isZeroIntegerLiteral handles Go integer literal formats (decimal, binary 0b, octal 0o, hex 0x, and underscores) by scanning characters for any nonzero digit and returns true only for literals that are lexically zero.
  • Add internal/codeguard/checks/reliability/reliability_go_helpers_test.go with unit tests covering zero/nonzero literals across bases and a regression test exercising a multi-million-digit untrusted literal to ensure the function completes quickly.
  • Apply formatting changes with gofmt to the modified files.

Testing

  • Ran go test ./internal/codeguard/checks/reliability and the package tests passed.
  • Ran go test ./tests/checks and the integration tests passed.
  • Ran go test ./... and the full test suite completed successfully.

Codex Task

@alxxjohn
alxxjohn merged commit c75b3ed into main Aug 19, 2026
16 checks passed
@alxxjohn
alxxjohn deleted the alexj/propose-fix-for-denial-of-service-vulnerability branch August 19, 2026 22:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant