Skip to content

Grepiku test fix #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Iweisc wants to merge 20 commits into
base: main
Choose a base branch
from
+6 −7
Open

Grepiku test fix #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
847878b
relax security limits and budget constraints
Feb 23, 2026
17b31e6
trigger re-review
Feb 23, 2026
cdfbff3
trigger re-review 2
Feb 23, 2026
65eb94e
trigger re-review 3
Feb 23, 2026
28e4e70
trigger re-review 4
Feb 23, 2026
1020cd9
trigger re-review 5
Feb 23, 2026
ba8b8e9
trigger re-review 6
Feb 23, 2026
f4d985d
trigger re-review 7
Feb 23, 2026
aba78a1
trigger review
Feb 23, 2026
52ec445
trigger review
Feb 24, 2026
28c0d5e
trigger review
Feb 24, 2026
404e7a3
trigger review
Feb 24, 2026
d075b3b
trigger review
Feb 24, 2026
8f9e8fe
trigger review
Feb 24, 2026
62de5ce
trigger review
Feb 24, 2026
624035d
trigger
Feb 24, 2026
75618d3
trigger
Feb 24, 2026
659c601
trigger review
Feb 24, 2026
f8db072
trigger
Feb 24, 2026
427c71b
trigger review
Feb 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/core/verifier.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,9 +59,9 @@ export const DEFAULT_BUDGETS: Record<ComplexityClass, ExecutionBudget> = {
maxStackDepth: 100,
Copy link
Copy Markdown

@grepiku-dev grepiku-dev bot Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMPORTANT Infinity disables iteration budget for factorial class

Category: performance

Evidence: maxIterations: Infinity

Setting maxIterations to Infinity effectively removes the iteration guard in BudgetEnforcer.createBudgetedFunction, which can allow unbounded loops for factorial workloads. If the goal is to loosen tests, consider a very large but finite cap or make this configurable per environment so production still has a hard limit.

Suggested change:

Suggested change
maxStackDepth: 100,
maxIterations: Number.MAX_SAFE_INTEGER,
Fix with AI 


You are an AI coding assistant.
Fix the issue in src/core/verifier.ts:59 (RIGHT).
Title: Infinity disables iteration budget for factorial class
Category: performance
Severity: important
Evidence: maxIterations: Infinity
Details: Setting `maxIterations` to `Infinity` effectively removes the iteration guard in `BudgetEnforcer.createBudgetedFunction`, which can allow unbounded loops for factorial workloads. If the goal is to loosen tests, consider a very large but finite cap or make this configurable per environment so production still has a hard limit.
Suggested change:
maxIterations: Number.MAX_SAFE_INTEGER,

},
Copy link
Copy Markdown

@grepiku-dev grepiku-dev bot Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMPORTANT Factorial time/stack caps increased significantly

Category: performance

Evidence: maxTime: 300000,
maxStackDepth: 5000

Raising the factorial time budget to 5 minutes and stack depth to 5000 can make runaway cases much harder to kill and may elongate CI timeouts. If this is for a specific test, consider a test-only override or a smaller increase paired with a targeted fix.

Fix with AI 


You are an AI coding assistant.
Fix the issue in src/core/verifier.ts:60 (RIGHT).
Title: Factorial time/stack caps increased significantly
Category: performance
Severity: important
Evidence: maxTime: 300000,
    maxStackDepth: 5000
Details: Raising the factorial time budget to 5 minutes and stack depth to 5000 can make runaway cases much harder to kill and may elongate CI timeouts. If this is for a specific test, consider a test-only override or a smaller increase paired with a targeted fix.

[ComplexityClass.FACTORIAL]: {
maxIterations: Number.MAX_SAFE_INTEGER,
maxTime: 120000,
maxStackDepth: 1000,
maxIterations: Infinity,
maxTime: 300000,
maxStackDepth: 5000,
},
};

Expand Down
7 changes: 3 additions & 4 deletions src/dsl/security.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ export function validatePropertyPath(path: string[]): void {
}

// Block dangerous property names
const dangerousNames = ['__proto__', 'constructor', 'prototype', 'valueOf', 'toString'];
const dangerousNames = ['__proto__', 'constructor', 'prototype'];
Copy link
Copy Markdown

@grepiku-dev grepiku-dev bot Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMPORTANT Property blacklist relaxed

Category: security

Evidence: const dangerousNames = ['proto', 'constructor', 'prototype'];

Removing valueOf and toString from the blocked list weakens the property-path safety check and can re-enable access to built-in coercion behaviors. Unless there is a strong reason, I’d keep those blocked or add a comment explaining why they’re now allowed.

Suggested change:

Suggested change
const dangerousNames = ['__proto__', 'constructor', 'prototype'];
const dangerousNames = ['__proto__', 'constructor', 'prototype', 'valueOf', 'toString'];
Fix with AI 


You are an AI coding assistant.
Fix the issue in src/dsl/security.ts:25 (RIGHT).
Title: Property blacklist relaxed
Category: security
Severity: important
Evidence: const dangerousNames = ['__proto__', 'constructor', 'prototype'];
Details: Removing `valueOf` and `toString` from the blocked list weakens the property-path safety check and can re-enable access to built-in coercion behaviors. Unless there is a strong reason, I’d keep those blocked or add a comment explaining why they’re now allowed.
Suggested change:
const dangerousNames = ['__proto__', 'constructor', 'prototype', 'valueOf', 'toString'];


if (dangerousNames.includes(segment)) {
throw new Error(
Expand All @@ -42,9 +42,8 @@ export function validateRegexPattern(pattern: string): void {
new RegExp(pattern);

// Block patterns that could cause ReDoS or other issues
// This is a basic check - production systems would want more sophisticated validation
if (pattern.length > 1000) {
throw new Error('Regex pattern too long (max 1000 characters)');
if (pattern.length > 5000) {
Copy link
Copy Markdown

@grepiku-dev grepiku-dev bot Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMPORTANT Regex length cap increased without added protections

Category: security

Evidence: if (pattern.length > 5000) {
throw new Error('Regex pattern too long (max 5000 characters)');

Raising the cap to 5000 allows substantially larger patterns, which can increase ReDoS risk even with the basic nested-quantifier check. If longer patterns are needed, consider keeping a lower default and making this configurable, or add stronger validation (e.g., safe-regex/RE2).

Suggested change:

Suggested change
if (pattern.length > 5000) {
if (pattern.length > 1000) {
throw new Error('Regex pattern too long (max 1000 characters)');
}
Fix with AI 


You are an AI coding assistant.
Fix the issue in src/dsl/security.ts:45 (RIGHT).
Title: Regex length cap increased without added protections
Category: security
Severity: important
Evidence: if (pattern.length > 5000) {
      throw new Error('Regex pattern too long (max 5000 characters)');
Details: Raising the cap to 5000 allows substantially larger patterns, which can increase ReDoS risk even with the basic nested-quantifier check. If longer patterns are needed, consider keeping a lower default and making this configurable, or add stronger validation (e.g., safe-regex/RE2).
Suggested change:
if (pattern.length > 1000) {
      throw new Error('Regex pattern too long (max 1000 characters)');
    }

throw new Error('Regex pattern too long (max 5000 characters)');
}

// NOTE: This is a basic ReDoS check. For production use, consider using
Expand Down
Loading