fix(security): restack bounded rate-limit decision bytes on 28af0b

[seonghobae]

Purpose

Rebuild only the unique rate-limit decision response-integrity delta from #376 directly on current protected main 28af0b1c2e76d066a5d41ef1da56157209c89431 after #373 advanced protected truth. No predecessor checks, reviews, scanner results, coverage evidence, statuses, or model findings transfer.

The internal Durable Object response is security-relevant because allowed, limit, remaining, and retry_after_seconds control whether credential exchange proceeds. Protected main still accepts the body through Response.json() without an application byte ceiling, fatal UTF-8 decoding, or duplicate decoded security-decision-key detection.

Test-first lineage

• ce02fe33c23d422d566c22bb6f134f7af12fb4b3 — RED: requires malformed UTF-8 rejection, escape-equivalent duplicate decision-key rejection, an undeclared/chunked byte ceiling, and declared oversize rejection before body access.
• e11f10d3438e280c87a08b87c06fe2c072403ba8 — GREEN: adds a 4,096-byte declared/streamed ceiling, fatal UTF-8 decoding, duplicate decoded top-level decision-key rejection before JSON.parse, and preserves the existing typed decision validator.
• 0b896868214908993c88d128e531b4580eca1980 — current exact head: records RFC 8259/I-JSON, Cloudflare Durable Object, finalized NIST SSDF 1.1, and draft SSDF 1.2 basis.

Fresh comparison against protected main is exactly three commits ahead, zero behind, changing only:

• src/rate-limit.ts
• test/rate-limit-response-integrity.test.ts
• docs/doctoring/rate-limit-response-integrity.md

Evidence boundary

This hardens only the Worker-to-Durable-Object response protocol. It does not authenticate a different Cloudflare account, prove production deployment/release/KPI/customer/revenue truth, choose an outbound license, or create acquisition evidence.

Do not merge until unchanged exact head 0b896868214908993c88d128e531b4580eca1980 has fresh terminal-success application ci, reviewer-ci, eligible protected-base central Security Scan, exact configured 100% owned-production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

No force update, destructive rebase, self-approval, gate weakening, reviewer/secret invention, repair/self-modifying workflow, release, deployment, or fabricated production evidence is introduced.

Supersedes #376 after exact-delta verification.

Summary by CodeRabbit

• 버그 수정

  • 분산 rate limit 응답의 잘못된 형식, 빈 본문, 손상된 문자 인코딩을 안전하게 처리합니다.
  • 응답 크기를 4,096바이트로 제한하고, 초과하거나 읽기에 실패하면 명확한 오류로 처리합니다.
  • 중복된 결정 키와 잘못된 JSON을 감지해 신뢰할 수 없는 응답이 허용되지 않도록 개선했습니다.

• 문서

  • 응답 무결성 검증 기준, 제한사항, 테스트 범위 및 관련 표준을 문서화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 72fe0618-cd37-4462-ba60-0c6f885f51ff

📥 Commits

Reviewing files that changed from the base of the PR and between 2e410f7 and ed3c537.

📒 Files selected for processing (2)

• src/rate-limit.ts
• test/rate-limit-response-integrity.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/rate-limit.ts

---

📝 Walkthrough

Walkthrough

Durable Object의 분산 rate-limit 응답을 제한된 스트림으로 읽도록 변경했다. 응답 크기, UTF-8, 중복 키, JSON, 빈 본문을 검증한다. 실패는 DistributedRateLimitUnavailable 오류로 처리한다. 테스트와 관련 문서를 추가했다.

Changes

분산 rate-limit 응답 무결성

Layer / File(s)	Summary
결정 JSON 검증 계약 src/rate-limit.ts	응답 최대 크기와 허용 결정 키를 정의했다. JSON 파싱 전에 최상위 중복 키와 이스케이프 해석 후 중복을 탐지한다.
제한된 응답 판독 흐름 src/rate-limit.ts	응답 스트림을 최대 4,096바이트까지 읽는다. 크기 초과, 빈 본문, 읽기 실패, 잘못된 UTF-8, 중복 키, 잘못된 JSON을 DistributedRateLimitUnavailable 오류로 변환한다.
무결성 검증 테스트와 문서 test/rate-limit-response-integrity.test.ts, docs/doctoring/rate-limit-response-integrity.md	응답 무결성 실패 조건과 content-length 사전 거부를 검증한다. 검증 순서, 제한사항, 표준 근거를 문서화한다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to ed3c5

This localized change hardens rate-limit response parsing; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant DurableObject
  participant checkDistributedRateLimit
  participant boundedDecisionReader
  participant JSONParser
  DurableObject->>checkDistributedRateLimit: rate-limit 응답 반환
  checkDistributedRateLimit->>boundedDecisionReader: 응답 본문 판독 요청
  boundedDecisionReader->>boundedDecisionReader: 크기와 UTF-8 검증
  boundedDecisionReader->>JSONParser: 중복 키 검증 후 JSON 텍스트 전달
  JSONParser-->>checkDistributedRateLimit: 결정 객체 또는 파싱 오류

Loading

Possibly related PRs

• ContextualWisdomLab/noema#269: src/rate-limit.ts의 상태와 미디어 타입 검증을 변경했다.
• ContextualWisdomLab/noema#305: 같은 응답 처리 경로에 프로토콜 검증을 추가했다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 rate-limit 응답의 바이트 제한과 보안 수정이라는 주요 변경을 나타내며 변경 내용과 관련됩니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rate-limit-response-integrity-28af0b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}