fix(mirror): reject oversized archives before allocation

Closed
TH
9d ago
+43-4

Issue #200 — local mirror I/O hardening

The official registry and local mirror already cap compressed FHIR package acquisition at 128 MiB. The pre-existing mirror reader used File::take(max+1), so it was bounded, but still read/allocated up to the limit before refusing an oversized (including sparse) on-disk file. This update checks the opened file's metadata().len() first and returns the same operational invalid-request size error without reading a known oversized file.

The stream retains its bound+1 probe to catch a growing file, clamps a caller-supplied u64::MAX cap to the canonical shared MAX_COMPRESSED_PACKAGE_ARCHIVE_BYTES, and retains exact-bound, below-bound, and missing-source semantics. No change to FHIR version resolution, compatibility policy, registry endpoints, oracle, cache identity, or pinned dependencies. This is a local availability/performance improvement, not a claim of new remote exploitability or consumer-contract review.

New regressions use a sparse file whose logical length is 128 MiB + 1 without writing 128 MiB, check a privacy-safe size error, ensure a larger caller bound cannot bypass the global ceiling, and preserve 4-byte exact/capped reads. Existing local mirror tests remain.

Execution and governance

Candidate base f82565cca917d119e1c774b2c470e2ac20e0d6dd and initial head df631321cff1ceb00127ff6ecb97fc4dc4b4784e. Require real rustfmt/Clippy/test and all exact-head technical CI. Then independently eligible human Code Owner approval under existing branch rules, last-push approval, thread resolution and a normal merge commit; finally fresh-main verification. A generic founder continuation instruction, neutral bot result or CI PASS does not waive these checks. Do not close #200 before post-merge proof. No protected AF-02, workflow, or ruleset file touched.

No local Windows execution, Jev model verdict or external review is asserted until genuinely run.

Summary by cubic

Fixes local mirror package acquisition so known-oversized archives fail before being read and buffered up to the 128 MiB cap.

  • Checks the opened file's metadata length before streaming and refuses with the same invalid-request size error.
  • Keeps the bound+1 streaming probe to catch files that grow after the metadata check.
  • Clamps a caller-supplied u64::MAX cap to the shared MAX_COMPRESSED_PACKAGE_ARCHIVE_BYTES ceiling.
  • Adds sparse-file and exact-bound regression tests; exact-bound and missing-source behavior is unchanged. Formatting only was adjusted in the follow-up commit.