Skip to content

[sec-check] fix(dashboard): cap decompressed audit log reads (readAuditLogFile) to defuse gzip bombs - #4863

Merged
clubanderson merged 1 commit into
v4from
sec-check/audit-gzip-limit
Aug 27, 2026
Merged

[sec-check] fix(dashboard): cap decompressed audit log reads (readAuditLogFile) to defuse gzip bombs#4863
clubanderson merged 1 commit into
v4from
sec-check/audit-gzip-limit

Conversation

@kubestellar-hive

@kubestellar-hive kubestellar-hive Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Security Fix

Cluster: src/pkg/dashboard/audit.go — readAuditLogFile only (disjoint from PR #4032's proxy/github auth cluster).

readAuditLogFile gunzipped rotated audit backups with unbounded io.ReadAll; a crafted/corrupted .gz in /data could expand a few KB into GBs and OOM the dashboard (local DoS of the control plane, CWE-409/CWE-400).

This wraps the reader in io.LimitReader capped at 64MB — >10x the 5MB lumberjack rotation size — so no legitimate file is truncated; a clipped trailing line simply fails json.Unmarshal and is skipped.

Tested: go test ./pkg/dashboard/ -run 'Audit|OutputActions' passes.

Fixes #4862

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required — do NOT merge without review, do NOT remove the hold label.

— hive: agent=sec-check backend=copilot model=claude-fable-5 copilot=1.0.78

sec-check
fix(dashboard): cap decompressed audit log reads to defuse gzip bombs
71d4529 
readAuditLogFile gunzipped rotated audit backups with an unbounded
io.ReadAll, so a crafted or corrupted .gz in /data could expand a few KB
into gigabytes and exhaust dashboard memory. Wrap the reader in
io.LimitReader capped at 64MB (>10x the 5MB lumberjack rotation size),
so no legitimate file is truncated and a clipped trailing line is
harmlessly skipped by the JSON-line parser.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Aug 27, 2026
@kubestellar-prow

kubestellar-prow Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Changelog: this PR changes code but does not touch CHANGELOG.md.

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a line under ## Unreleased. If it is a refactor, a
test-only change, or dependency churn, no entry is needed and you can
ignore this.

This is a reminder, not a gate; it never blocks a merge.

@kubestellar-prow kubestellar-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Aug 27, 2026
@kubestellar-hive kubestellar-hive Bot added security agent/security Approved by a Hive merger/owner for auto-merge on green CI hive/hosted-available-oke-11-placeholder-r05x Approved by a Hive merger/owner for auto-merge on green CI labels Aug 27, 2026
This was referenced Aug 27, 2026
Merged
Merged
Closed
@clubanderson
clubanderson merged commit 53318db into v4 Aug 27, 2026
39 of 40 checks passed
@clubanderson
clubanderson deleted the sec-check/audit-gzip-limit branch August 27, 2026 12:18
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution! Your PR has been merged.

Check out what's new:

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

@clubanderson clubanderson mentioned this pull request Aug 27, 2026
Merged
@kubestellar-hive kubestellar-hive Bot mentioned this pull request Aug 27, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agent/security Approved by a Hive merger/owner for auto-merge on green CI copilot dco-signoff: yes Indicates the PR's author has signed the DCO. hive/hosted-available-oke-11-placeholder-r05x Approved by a Hive merger/owner for auto-merge on green CI hold security size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[sec-check] Unbounded gzip decompression when reading rotated audit logs (readAuditLogFile) — memory-exhaustion / gzip-bomb risk

1 participant

@clubanderson