Skip to content

Validate sprint8 CLI input (Crib & PackedPrefix) - #79

Closed
krotname wants to merge 1 commit into
mainfrom
codex/fix-unchecked-input-vulnerability-in-sprint8
Closed

Validate sprint8 CLI input (Crib & PackedPrefix)#79
krotname wants to merge 1 commit into
mainfrom
codex/fix-unchecked-input-vulnerability-in-sprint8

Conversation

@krotname

Copy link
Copy Markdown
Owner

Motivation

  • The Crib and PackedPrefix CLI solvers assumed well-formed, lowercase input and unbounded dictionary sizes, which allowed crafted stdin to trigger uncaught runtime exceptions (e.g. ArrayIndexOutOfBoundsException and NegativeArraySizeException) and crash the process.
  • The change prevents availability issues by validating grammar, character ranges, bracket balance, and numeric bounds before using input as array indexes or allocation sizes.

Description

  • Added isLowercaseWord checks in Crib.solve to reject any text or dictionary word containing characters outside 'a'..'z', and changed the aggregate dictionary-size accumulator to long with a guard against overflow before allocating the trie.
  • Added an early check in Crib.run to reject negative n and return NO instead of allocating arrays with attacker-controlled sizes.
  • Added isValidPacked in PackedPrefix to validate encoded-string grammar (lowercase literals, digits followed by '[', bracket balance, no unmatched ], and disallowed characters) and applied it to the first and each subsequent packed string before decoding/comparison.
  • Hardened PackedPrefix.run to handle n <= 0 and to stop/return early when invalid packed input is detected, avoiding use of matchingBracket or frame stacks on malformed strings.

Testing

  • Ran the full test suite with Maven using mvn test and observed Tests run: 546, Failures: 0, Errors: 0, Skipped: 0 and BUILD SUCCESS.

Codex Task

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a57e06c3dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/main/java/algorithms/sprint8/PackedPrefix.java
Comment thread src/main/java/algorithms/sprint8/PackedPrefix.java
@krotname

krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner Author

Закрываю как superseded by #116: изменения перенесены в одну проверенную ветку, все review findings учтены; локальный mvn verify прошёл полностью.

@krotname krotname closed this Aug 1, 2026
@krotname
krotname deleted the codex/fix-unchecked-input-vulnerability-in-sprint8 branch August 1, 2026 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant