fix(cli): preflight bounded JSON and lockfile inputs without exposing host paths

Closed
TH
11d ago
+51-11

V2 scoped hardening — issue #202

Both existing CLI input readers already bound their allocations using take(limit+1), but known-oversized local regular files still cost a full upper-bound read. Also, read_bounded_file included path.display() in the input-overflow error. When displayed as commandf: diagnostics or GitHub annotations, this could expose local absolute paths. This PR preflights the size of the already-opened file before reading and replaces the oversized JSON diagnostic with a stable, path-free message.

  • main.rs::read_bounded_file: early metadata().len() ceiling, retain take(limit+1) and post-read ceiling check for growth since metadata; no untrusted path in oversized input message.
  • lock_input.rs::read_lockfile: same early metadata check, retaining original 16 MiB byte ceiling, v1/v2 parsing and fail-closed error semantics.
  • Negative tests: command-line github-annotations refuses a sparse >64 MiB JSON input without leaking its absolute path; sparse oversized lockfile emits a stable size error rather than a JSON parser error. Existing positive CLI, lockfile and actual FHIR-package proof tests remain authoritative.

Boundaries: No change to compatibility verdicts, registry, package cache, compressed archive limits, FHIR oracle, AF-02 verifier, protected workflow/ruleset, dependencies, signatures or clinical data. This is not a complete consumer-contract commandf review and is not an atomic snapshot claim.

Required qualification: exact-head Rustfmt/Clippy/tests and all required GitHub CI, independent last-push-valid human Code Owner APPROVED, resolved discussions, normal merge commit and fresh-main CI before marking issue #202 resolved. Bot COMMENTED or NEUTRAL does not approve anything. Reviewer-access blocker #195 remains open, as do other candidate PRs; no admin bypass is authorized.

Base f82565cca917d119e1c774b2c470e2ac20e0d6dd. First head fc5ff329d48ff4a5b833b0da64bfa58cb8df2542.

Summary by cubic

Preflights CLI input file sizes before reading and removes absolute host paths from oversized-input errors. Known-oversized JSON and lockfile inputs now fail early instead of performing a full upper-bound read, and existing growth-after-metadata checks are retained. Oversized-input diagnostics no longer include the file's absolute path, preventing path leakage in commandf annotations.