Skip to content

fix(sec): address MEM-19 input validation and error sanitization#107

Open
ducnmm wants to merge 1 commit intosec/security_fixfrom
sec/mem-19-fixes
Open

fix(sec): address MEM-19 input validation and error sanitization#107
ducnmm wants to merge 1 commit intosec/security_fixfrom
sec/mem-19-fixes

Conversation

@ducnmm
Copy link
Copy Markdown
Collaborator

@ducnmm ducnmm commented Apr 14, 2026

This PR addresses the security findings outlined in MEM-19:

  • Input Validation: Enforces a maximum of 20 extracted facts (MAX_ANALYZE_FACTS) and limits individual fact length to 500 characters. Validates Sui addresses for the owner field in the sidecar. Implemented validate_namespace validation across all relevant endpoints.
  • Error Sanitization: Prevents leaking internal infrastructure details (like connection strings or raw API errors) to the client. Returns generic error messages and logs detailed errors internally with a unique Correlation/Reference ID.
  • Rate Limiting Adjustment: Adjusted the rate limit weighting for the /api/analyze endpoint to use a base weight of 5 and an additional weight of 2 per extracted fact.

@ducnmm ducnmm changed the base branch from dev to sec/security_fix April 14, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant