Skip to content

fix(merk): reject overlong keys before encoding - #728

Merged
QuantumExplorer merged 1 commit into
developfrom
codex/fix-681-merk-overlong-keys
Jul 6, 2026
Merged

fix(merk): reject overlong keys before encoding#728
QuantumExplorer merged 1 commit into
developfrom
codex/fix-681-merk-overlong-keys

Conversation

@QuantumExplorer

Copy link
Copy Markdown
Member

Summary

  • reject raw Merk apply batches containing keys longer than 255 bytes before mutating the tree
  • make Merk link encoding return an error for overlong keys instead of relying on debug assertions
  • make grovedb-query proof op encoding use checked key-length conversion for every key-bearing variant

Fixes #681.

Verification

  • cargo test -p grovedb-merk apply_rejects_overlong_keys --lib
  • cargo test -p grovedb-merk encode_link_long_key --lib
  • cargo test -p grovedb-query long_key --lib
  • cargo test -p grovedb-merk apply_rejects_overlong_keys --lib --release
  • cargo test -p grovedb-merk encode_link_long_key --lib --release
  • cargo test -p grovedb-query long_key --lib --release
  • cargo test -p grovedb-merk -p grovedb-query

@coderabbitai

coderabbitai Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

Warning

Rate limit exceeded

@QuantumExplorer has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 35 minutes and 39 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2f9b6388-bf65-468f-9ea1-1739d96a64ed

📥 Commits

Reviewing files that changed from the base of the PR and between a2129a9 and f758271.

📒 Files selected for processing (4)
  • grovedb-query/src/proofs/encoding.rs
  • merk/src/merk/apply.rs
  • merk/src/merk/mod.rs
  • merk/src/tree/link.rs
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/fix-681-merk-overlong-keys

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov

codecov Bot commented May 20, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 91.17647% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.44%. Comparing base (60f2968) to head (f758271).
⚠️ Report is 3 commits behind head on develop.

Files with missing lines Patch % Lines
grovedb-query/src/proofs/encoding.rs 87.75% 12 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##           develop     #728      +/-   ##
===========================================
+ Coverage    91.42%   91.44%   +0.01%     
===========================================
  Files          236      236              
  Lines        67053    67161     +108     
===========================================
+ Hits         61305    61416     +111     
+ Misses        5748     5745       -3     
Components Coverage Δ
grovedb-core 88.94% <ø> (ø)
merk 92.29% <100.00%> (+0.02%) ⬆️
storage 86.36% <ø> (ø)
commitment-tree 96.43% <ø> (ø)
mmr 96.79% <ø> (+0.03%) ⬆️
bulk-append-tree 89.39% <ø> (+0.13%) ⬆️
element 97.38% <ø> (+0.01%) ⬆️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@QuantumExplorer QuantumExplorer changed the title Reject overlong Merk keys before encoding fix(merk): reject overlong keys before encoding May 21, 2026
@QuantumExplorer

Copy link
Copy Markdown
Member Author

Reviewed

@QuantumExplorer
QuantumExplorer merged commit eaad013 into develop Jul 6, 2026
10 checks passed
@QuantumExplorer
QuantumExplorer deleted the codex/fix-681-merk-overlong-keys branch July 6, 2026 20:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[audit][low] Raw Merk accepts overlong keys that encode incorrectly

1 participant