fix(source-map): cap local FSH line-count scans at 64 MiB

Closed
TH
15d ago
+81-1

Linked finding

Issue #198. Existing CF-09 source mapping validates canonicalized source paths and line ranges, but its source_line_count streams local files until EOF without a byte budget, while the CheckReport and index inputs have explicit bounds. A very large locally edited file can force unbounded disk IO and time before determining whether the SUSHI mapping is valid. No remote exploitability, clinical effect, or performance benchmark claim is made.

Narrow change

  • Cap the FSH source bytes examined by the current-tree line counter at 64 MiB.
  • Reject over-limit regular files from the opened file's metadata() before reading; keep an additional budget+1 streaming probe so growth after the metadata check also fails closed.
  • New SourceMapError::SourceTooLarge { maximum } deliberately omits absolute host paths and source content from its message.
  • Preserve line counts for empty files and trailing/non-trailing newline, existing repo root canonicalization and symlink-escape guards, and original CF-04/05 check/compatibility authority.
  • Unit regression covers exact/+1 17-byte and 18-byte line counts, empty source, and a sparse over-64-MiB file. Integration regression requires the actual mapped build_source_mapped_check_report path to refuse a sparse oversized FSH file before publishing a location. The sparse test does not physically write 64 MiB.

Explicit limits

FSH source mapping still does not prove that an unchanged-length content edit can be detected from a stale SUSHI index. This is an availability bound, not content provenance, a signed receipt, or full commandf review functionality. Does not alter registry/cache acquisition, package bytes, clinical oracle, AF-02 protected files, governance, Actions workflows or dependencies.

Required gates

Exact-head Rust format, Clippy, focused tests and complete GitHub CI must qualify this head. An eligible independent human Code Owner approval (issue #195), last-push-valid approval, thread resolution and normal merge commit are required before treating the change as canonical. Never use neutral bot feedback or author self-approval as a substitute. Keep issue #198 open until post-main proof.

Base observed f82565cca917d119e1c774b2c470e2ac20e0d6dd / initial head 12adf80b7666dd992951cfdb562063f3693e393c.

Summary by cubic

Caps the FSH source line counter at 64 MiB so oversized local files no longer force unbounded disk reads during source mapping validation.

  • Rejects files over the limit from metadata() before reading, with a one-byte streaming probe to catch file growth after the check.
  • Adds SourceMapError::SourceTooLarge, which omits host paths and source content from its message.
  • Documents the bound, size-error behavior, and non-atomic freshness limits in the CF-09 spec.
  • Preserves line counting for empty files and trailing newlines, plus existing path canonicalization and symlink-escape guards.
  • Unit and integration tests cover the exact boundary, empty sources, and a sparse oversized file without physically writing 64 MiB.