mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
079fcd2631
Follow-up to a full re-audit of the 2.0 tree. Most prior findings were already fixed; this closes the ones that were not: - SAML assertion replay: validateInResponseTo ifPresent plus a Redis-backed CacheProvider, so a captured signed assertion cannot be replayed. ifPresent keeps IdP-initiated SSO working. - MFA login challenge burned after 5 wrong TOTP codes. - api_keys.key_prefix indexed; the per-request lookup was a full table scan. - MAX_AI_JOBS_PER_USER caps a user's in-flight single-file AI jobs (the AI pool runs at concurrency 1). Batch and pipeline AI stay uncapped. - MAX_WORKSPACE_SIZE_GB enforced instead of being dead config. - SUBPROCESS_MEMORY_LIMIT_MB (default off) for the native media and doc engines; not applied to the AI sidecar. - SVG sanitizer closes unquoted and whitespace-prefixed javascript: hrefs and the animateTransform/animateMotion/handler/mpath elements. - Windows-style paths stripped from error output to match the Sentry scrubber. - Postgres and Redis compose services get cap_drop plus pids_limit and cpus. - .env.example ships MAX_SVG_SIZE_MB=50 (0 disabled the cap). Adds security-focused unit and integration tests. typecheck, biome, and the full unit and integration suites pass.
27 lines
1.4 KiB
TypeScript
27 lines
1.4 KiB
TypeScript
/**
|
|
* Optional per-subprocess address-space cap (RLIMIT_AS) for the native media and
|
|
* document engines.
|
|
*
|
|
* When SUBPROCESS_MEMORY_LIMIT_MB is a positive integer, the command runs under
|
|
* /bin/sh, which sets `ulimit -v` and then `exec`s the real binary with its exact
|
|
* argv. `exec "$@"` does not re-parse the arguments through the shell, so this
|
|
* stays injection-safe. A decompression bomb or runaway filter graph is then
|
|
* killed at that ceiling instead of driving the whole container to the cgroup
|
|
* OOM-killer (which would take every in-flight job down with it).
|
|
*
|
|
* Disabled by default (unset or 0): the container memory limit remains the
|
|
* primary backstop, and `ulimit -v` is a blunt instrument (it caps virtual
|
|
* address space, not RSS). `|| true` makes it a no-op where `ulimit -v` is
|
|
* unsupported, e.g. macOS.
|
|
*
|
|
* Deliberately NOT applied to the Python AI sidecar: ML frameworks (torch, CUDA)
|
|
* reserve very large virtual address space without touching it, so an RLIMIT_AS
|
|
* cap would break legitimate model loads. Those rely on the container limit.
|
|
*/
|
|
export function wrapWithMemoryLimit(bin: string, args: string[]): [string, string[]] {
|
|
const mb = Number.parseInt(process.env.SUBPROCESS_MEMORY_LIMIT_MB ?? "", 10);
|
|
if (!Number.isFinite(mb) || mb <= 0) return [bin, args];
|
|
const script = 'ulimit -v "$1" 2>/dev/null || true; shift; exec "$@"';
|
|
return ["/bin/sh", ["-c", script, "sh", String(mb * 1024), bin, ...args]];
|
|
}
|