t1398.2: Harden ShellCheck invocation to prevent exponential expansion#2885
t1398.2: Harden ShellCheck invocation to prevent exponential expansion#2885alex-solovyev merged 1 commit intomainfrom
Conversation
…1398.2) - pulse-wrapper.sh quality sweep: add --norc to ignore .shellcheckrc source-path=SCRIPTDIR, preventing implicit source following; add ulimit -v 1GB per subprocess to cap virtual memory - linters-local.sh: wrap shellcheck in subshell with ulimit -v 1GB for both timeout and portable-fallback paths - .shellcheckrc: add warning comment about exponential expansion risk when combined with -x/--external-sources - Update guard_child_processes() comment to reflect defense-in-depth layering (process guard is secondary, not primary defense) Root cause: shellcheck --external-sources with source-path=SCRIPTDIR follows source directives across 100+ scripts, causing exponential expansion (5.7 GB RSS, 88% CPU, 35+ min — March 3 kernel panic). Closes #2875
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the robustness of ShellCheck invocations within the system's linting scripts. The primary goal is to prevent resource exhaustion and system instability caused by runaway ShellCheck processes, particularly those involving recursive source expansions. The changes introduce multiple layers of protection, ensuring that both automated quality sweeps and interactive linting sessions operate within defined resource limits. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Thu Mar 5 03:47:47 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request effectively hardens the ShellCheck invocations in pulse-wrapper.sh and linters-local.sh to prevent the previously observed exponential source expansion and resulting system instability. The use of ulimit, --norc, and per-file timeouts creates a robust, multi-layered defense. The accompanying comments and documentation updates are clear and very helpful for future maintenance.
I have one suggestion in pulse-wrapper.sh to improve debuggability by not suppressing stderr, in line with the project's general guidelines.
| # ulimit -v in subshell to cap RSS per shellcheck process. | ||
| result=$( | ||
| ulimit -v 1048576 2>/dev/null || true | ||
| $sc_timeout_cmd shellcheck --norc -f gcc "$shfile" 2>/dev/null || true |
There was a problem hiding this comment.
The use of 2>/dev/null here suppresses all standard error output from the shellcheck command. This can hide important diagnostic information if the command fails for reasons other than finding linting issues (e.g., 'command not found', file permission errors). This practice goes against the repository's general rule to avoid blanket error suppression to aid in debugging. The || true is sufficient to prevent script termination on a non-zero exit code. Removing the redirection will allow legitimate system errors to be visible while still capturing the intended shellcheck output.
| $sc_timeout_cmd shellcheck --norc -f gcc "$shfile" 2>/dev/null || true | |
| $sc_timeout_cmd shellcheck --norc -f gcc "$shfile" || true |
References
- Avoid using '2>/dev/null' for blanket suppression of command errors in shell scripts to ensure that authentication, syntax, or system issues remain visible for debugging.
|
Follow-up: root cause removed in PR #2939 This PR hardened shellcheck invocations with --norc, timeouts, and ulimit. PR #2939 removes the root cause ( Upstream hazard note: The bash-language-server still hardcodes |
2 participants
Summary
pulse-wrapper.shandlinters-local.shto prevent the exponential source expansion that caused the March 3 kernel panic (5.7 GB RSS, 88% CPU, 35+ min runtime)--norcflag to pulse-wrapper.sh quality sweep to ignore.shellcheckrc'ssource-path=SCRIPTDIRdirectiveulimit -v 1GBper-subprocess memory cap as defense-in-depth in both scriptsChanges
pulse-wrapper.sh (quality sweep)
--norc: Prevents.shellcheckrcfrom being read, which setssource-path=SCRIPTDIRand could cause implicit source following-x/--external-sources: Already the case, now explicitly documentedulimit -v 1048576: Caps virtual memory to 1 GB per shellcheck subprocessguard_child_processes()comment: Clarifies this is a secondary defense, not primarylinters-local.sh (interactive linting)
ulimit -v 1048576: Added to both timeout and portable-fallback paths-x -P SCRIPTDIR: Interactive use benefits from source resolution; per-file timeout + ulimit provide sufficient protection.shellcheckrc
source-path=SCRIPTDIRis combined with--external-sourcesDefense-in-Depth Layers
-x(never follows sources)-x -P SCRIPTDIR(restricted)--norc(ignores .shellcheckrc)ulimit -v 1GBper subprocessulimit -v 1GBper subprocessguard_child_processes()every 60sCloses #2875