feat(fs): add filesystem limits and zip bomb protection - #102
Merged
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
- Add FsLimits struct with max_total_bytes (100MB default), max_file_size (10MB default), max_file_count (10K default) - Enforce limits in InMemoryFs write_file/append_file - Add OverlayFs limit enforcement for combined view - Add usage() and limits() methods to FileSystem trait - Add du and df builtins for disk usage reporting - Add zip bomb protection to tar/gzip decompression: - Check decompression ratio (max 100:1) - Check output size against limits - Update threat model with filesystem exhaustion vector - Add extensive test coverage for all limit scenarios https://claude.ai/code/session_01LFeocdydaMcL67hk9kuHr2
Add section 1.6 covering: - Symlink loops (mitigated - no symlink following) - Deep directory nesting (vulnerable) - Long filenames (vulnerable) - Unicode path attacks (vulnerable) Update vulnerability summary with V8-V10 for path attacks. Add zip bomb protection and symlink loop mitigations to controls matrix. https://claude.ai/code/session_01LFeocdydaMcL67hk9kuHr2
du is now a builtin, so it should not be in the list of commands expected to return exit 127. https://claude.ai/code/session_01LFeocdydaMcL67hk9kuHr2
chaliy
force-pushed
the
claude/investigate-memory-fs-limits-V1y9S
branch
from
February 3, 2026 04:28
dba6d69 to
baa9aea
Compare
chaliy
added a commit
that referenced
this pull request
May 30, 2026
## Summary - Add `FsLimits` struct with configurable limits (100MB total, 10MB per file, 10K files default) - Enforce limits in `InMemoryFs` and `OverlayFs` - Add `usage()` and `limits()` methods to `FileSystem` trait - Add `du` and `df` builtins for disk usage reporting - Add zip bomb protection to tar/gzip decompression (max 100:1 ratio) - Document filesystem exhaustion and path/name attack vectors in threat model ## Test plan - [x] Unit tests for `FsLimits` struct and checks - [x] Tests for `InMemoryFs` limit enforcement (file size, total bytes, file count) - [x] Tests for append respecting limits - [x] Tests for `du` and `df` builtins - [x] Tests for zip bomb protection (ratio check, size limits) - [x] All 561 library tests passing - [x] `cargo fmt --check` passing - [x] `cargo clippy -- -D warnings` passing https://claude.ai/code/session_01LFeocdydaMcL67hk9kuHr2 --------- Co-authored-by: Claude <noreply@anthropic.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
FsLimitsstruct with configurable limits (100MB total, 10MB per file, 10K files default)InMemoryFsandOverlayFsusage()andlimits()methods toFileSystemtraitduanddfbuiltins for disk usage reportingTest plan
FsLimitsstruct and checksInMemoryFslimit enforcement (file size, total bytes, file count)duanddfbuiltinscargo fmt --checkpassingcargo clippy -- -D warningspassinghttps://claude.ai/code/session_01LFeocdydaMcL67hk9kuHr2