Skip to content

Harden glyph codecs across runtimes#1

Merged
phenomenon0 merged 2 commits intomainfrom
codex
Mar 7, 2026
Merged

Harden glyph codecs across runtimes#1
phenomenon0 merged 2 commits intomainfrom
codex

Conversation

@phenomenon0
Copy link
Contributor

Summary

  • harden GLYPH codecs across C, Go, JS, Python, and Rust
  • fix parser strictness, recursion/resource caps, type validation, and memory-safety edges
  • add regression coverage for the audited security issues

Included

  • C: schema evolution free-path fix, JSON strictness/depth caps, validator OOM hardening, decimal/int edge fixes
  • Go: trailing-garbage rejection, packed parser fixes, incremental parser hardening, loose number parsing fixes
  • JS: prototype-pollution hardening, GS1 header bounds, stream validator type enforcement, packed parser and patch validation
  • Python: strict parsing, duplicate-key consistency, depth/buffer limits, validator hardening
  • Rust: Decimal128 safety fixes, recursion guards, strict schema evolution, stream validator hardening

Verification

  • cd glyph/go && GOCACHE=/tmp/codex-gocache-glyph go test ./glyph/...
  • cd glyph/js && npm test -- --runInBand
  • cd glyph/js && npm run typecheck
  • cd glyph/py && pytest -q
  • cd glyph/rust/glyph-codec && cargo test
  • cd glyph/c/glyph-codec && make test

phenomenon0 and others added 2 commits March 7, 2026 16:38
…eam_validator

These compiled outputs were not tracked, causing Go cross-impl tests
to fail in CI with "Cannot find module './decimal128'".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@phenomenon0 phenomenon0 merged commit b3fd01f into main Mar 7, 2026
6 checks passed
@phenomenon0 phenomenon0 deleted the codex branch March 7, 2026 23:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant