fix(security): restack bounded rate-limit decision bytes on 28af0b - #383
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughDurable Object의 분산 rate-limit 응답을 제한된 스트림으로 읽도록 변경했다. 응답 크기, UTF-8, 중복 키, JSON, 빈 본문을 검증한다. 실패는 Changes분산 rate-limit 응답 무결성
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to This localized change hardens rate-limit response parsing; no actionable merge-blocking risk remains after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant DurableObject
participant checkDistributedRateLimit
participant boundedDecisionReader
participant JSONParser
DurableObject->>checkDistributedRateLimit: rate-limit 응답 반환
checkDistributedRateLimit->>boundedDecisionReader: 응답 본문 판독 요청
boundedDecisionReader->>boundedDecisionReader: 크기와 UTF-8 검증
boundedDecisionReader->>JSONParser: 중복 키 검증 후 JSON 텍스트 전달
JSONParser-->>checkDistributedRateLimit: 결정 객체 또는 파싱 오류
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
24 tasks
This was referenced Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Rebuild only the unique rate-limit decision response-integrity delta from #376 directly on current protected
main28af0b1c2e76d066a5d41ef1da56157209c89431after #373 advanced protected truth. No predecessor checks, reviews, scanner results, coverage evidence, statuses, or model findings transfer.The internal Durable Object response is security-relevant because
allowed,limit,remaining, andretry_after_secondscontrol whether credential exchange proceeds. Protected main still accepts the body throughResponse.json()without an application byte ceiling, fatal UTF-8 decoding, or duplicate decoded security-decision-key detection.Test-first lineage
ce02fe33c23d422d566c22bb6f134f7af12fb4b3— RED: requires malformed UTF-8 rejection, escape-equivalent duplicate decision-key rejection, an undeclared/chunked byte ceiling, and declared oversize rejection before body access.e11f10d3438e280c87a08b87c06fe2c072403ba8— GREEN: adds a 4,096-byte declared/streamed ceiling, fatal UTF-8 decoding, duplicate decoded top-level decision-key rejection beforeJSON.parse, and preserves the existing typed decision validator.0b896868214908993c88d128e531b4580eca1980— current exact head: records RFC 8259/I-JSON, Cloudflare Durable Object, finalized NIST SSDF 1.1, and draft SSDF 1.2 basis.Fresh comparison against protected main is exactly three commits ahead, zero behind, changing only:
src/rate-limit.tstest/rate-limit-response-integrity.test.tsdocs/doctoring/rate-limit-response-integrity.mdEvidence boundary
This hardens only the Worker-to-Durable-Object response protocol. It does not authenticate a different Cloudflare account, prove production deployment/release/KPI/customer/revenue truth, choose an outbound license, or create acquisition evidence.
Do not merge until unchanged exact head
0b896868214908993c88d128e531b4580eca1980has fresh terminal-success applicationci,reviewer-ci, eligible protected-base centralSecurity Scan, exact configured 100% owned-production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.No force update, destructive rebase, self-approval, gate weakening, reviewer/secret invention, repair/self-modifying workflow, release, deployment, or fabricated production evidence is introduced.
Supersedes #376 after exact-delta verification.
Summary by CodeRabbit
버그 수정
문서