🛡️ Sentinel: [HIGH] JSON DoS 취약점 해결

.jules/sentinel.md

@@ -22,3 +22,8 @@ Explicitly defining `allow_pickle=False` is a robust defense-in-depth practice.
 **Vulnerability:** MD5 hashing in `fast_mlsirm/report.py` triggered a high severity warning by Bandit, because by default it is assumed to be used for security purposes which is unsafe due to weak hashing.
 **Learning:** For non-security purposes like generating unique dom ids, `hashlib.md5()` triggers a vulnerability warning unless `usedforsecurity=False` is passed. This allows bypassing FIPS compliance limitations as well as suppressing false positive warnings.
 **Prevention:** Always add `usedforsecurity=False` parameter to `hashlib.md5` and other weak hashing functions unless they are genuinely used for secure cryptography (which they shouldn't be).
+
+## 2026-07-23 - [Denial of Service via Unbounded JSON Parsing]
+**Vulnerability:** In `fast_mlsirm/report.py`, `json.loads` was used to directly parse the contents of a file without any byte-size or nesting constraints, creating an insecure deserialization path for a DoS attack.
+**Learning:** Always use bounds-checking when deserializing JSON. This prevents a maliciously crafted JSON file from exhausting memory or forcing recursive evaluation that crashes the application.
+**Prevention:** Use the `_load_json_bounded` utility in `fast_mlsirm.io` instead of direct `json.loads(file.read_text())` for safely processing input JSON files.

python/fast_mlsirm/report.py

@@ -1,8 +1,8 @@
 from __future__ import annotations
 
 import hashlib
-import json
 import math
+from .io import _load_json_bounded
 from html import escape
 from pathlib import Path
 from typing import Any
@@ -17,7 +17,7 @@ def render_diagnostics_report(
     """Render saved diagnostics JSON as a standalone HTML report."""
 
     source = Path(diagnostics_path)
-    payload = json.loads(source.read_text(encoding="utf-8"))
+    payload = _load_json_bounded(source, source="diagnostics JSON")
     if not isinstance(payload, dict):
         raise ValueError("diagnostics JSON must contain an object")