🛡️ Sentinel: [MEDIUM] Add input length limits to prevent DoS by abhimehro · Pull Request #412 · abhimehro/ctrld-sync

abhimehro · 2026-02-21T11:22:12Z

🚨 Severity: MEDIUM
💡 Vulnerability: The application accepted unlimited length strings for folder names and rules, posing a Denial of Service (DoS) risk.
🎯 Impact: Attackers could supply extremely long strings via malicious blocklists or inputs, potentially crashing the application or downstream services.
🔧 Fix: Enforced explicit length limits (64 for folder names/IDs, 255 for rules) in validation functions.
✅ Verification: Added tests/test_security_limits.py covering boundary conditions.

PR created automatically by Jules for task 12467936797948403414 started by @abhimehro

Co-authored-by: abhimehro <84992105+abhimehro@users.noreply.github.com>

google-labs-jules · 2026-02-21T11:22:13Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

trunk-io · 2026-02-21T11:22:15Z

😎 Merged manually by @abhimehro - details.

github-actions · 2026-02-21T11:22:21Z

👋 Development Partner is reviewing this PR. Will provide feedback shortly.

gemini-code-assist · 2026-02-21T11:22:27Z

Summary of Changes

Hello @abhimehro, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly strengthens the application's security by introducing crucial input length validation. The core objective is to prevent potential Denial of Service (DoS) attacks that could arise from processing excessively long strings in fields like folder names and rules. By enforcing explicit maximum lengths, the changes ensure that the system is more resilient against malicious inputs designed to overwhelm or crash the application.

Highlights

Denial of Service (DoS) Vulnerability Addressed: Identified and mitigated a medium-severity DoS vulnerability where the application previously accepted unlimited length strings for folder names and rules, which could lead to system instability or crashes.
Input Length Limits Enforced: Implemented explicit maximum length limits for critical input fields: 64 characters for folder names and profile IDs, and 255 characters for rules, to prevent oversized malicious inputs.
Enhanced Security Test Coverage: Added a new dedicated test file (tests/test_security_limits.py) to thoroughly verify the correct enforcement of the newly introduced input length limits and their boundary conditions.
Security Documentation Updated: Updated the .jules/sentinel.md security documentation to include a new entry detailing the vulnerability of missing input length limits and the best practices for prevention.

Changelog

.jules/sentinel.md
- Added a new security learning entry for 'Missing Input Length Limits (DoS Risk)'.
main.py
- Defined MAX_FOLDER_NAME_LENGTH, MAX_RULE_LENGTH, and MAX_PROFILE_ID_LENGTH constants.
- Modified is_valid_profile_id_format to utilize the MAX_PROFILE_ID_LENGTH constant for its length check.
- Updated validate_profile_id to use the MAX_PROFILE_ID_LENGTH constant and an f-string for improved error logging.
- Introduced a length validation check using MAX_RULE_LENGTH within the is_valid_rule function.
- Added a length validation check using MAX_FOLDER_NAME_LENGTH within the is_valid_folder_name function.
tests/test_security_limits.py
- Added a new test file to specifically verify the new input length limits for folder names, rules, and profile IDs.

Activity

PR created automatically by Jules for task 12467936797948403414, initiated by @abhimehro.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

tests/test_security_limits.py

+
+    # This should return False after the fix, but currently returns True
+    # We assert False to confirm the "failure" (vulnerability presence) or "success" (fix verification)
+    assert main.is_valid_folder_name(long_name) is False


tests/test_security_limits.py

+def test_is_valid_folder_name_acceptable_length():
+    """Test that folder names within limit are accepted."""
+    name = "a" * 64
+    assert main.is_valid_folder_name(name) is True


tests/test_security_limits.py

+    long_rule = "a" * 256 + ".com"
+
+    # This should return False after the fix
+    assert main.is_valid_rule(long_rule) is False


tests/test_security_limits.py

+def test_is_valid_rule_acceptable_length():
+    """Test that rules within limit are accepted."""
+    rule = "a" * 250 + ".com"
+    assert main.is_valid_rule(rule) is True


tests/test_security_limits.py

+    """
+    # 65 chars
+    long_id = "a" * 65
+    assert main.validate_profile_id(long_id, log_errors=False) is False


tests/test_security_limits.py

+
+    # 64 chars
+    valid_id = "a" * 64
+    assert main.validate_profile_id(valid_id, log_errors=False) is True


Copilot

Pull request overview

This PR hardens input validation to reduce DoS risk by enforcing maximum lengths for user-/blocklist-controlled strings (folder names, rules, and profile IDs) and adds tests to validate the new limits.

Changes:

Introduced module-level max-length constants for folder names, rules, and profile IDs.
Enforced length limits in is_valid_folder_name(), is_valid_rule(), and validate_profile_id() / is_valid_profile_id_format().
Added a new test module to validate length boundaries for the affected validators.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
`main.py`	Adds and applies max-length constants to validation functions to mitigate DoS from unbounded inputs.
`tests/test_security_limits.py`	Adds tests intended to cover boundary behavior for new length limits.
`.jules/sentinel.md`	Documents the new “missing input length limits” security finding and prevention guidance.

Copilot · 2026-02-21T11:24:21Z

tests/test_security_limits.py

+    # Create a rule with 256 characters (valid chars)
+    long_rule = "a" * 256 + ".com"
+
+    # This should return False after the fix
+    assert main.is_valid_rule(long_rule) is False
+
+def test_is_valid_rule_acceptable_length():
+    """Test that rules within limit are accepted."""
+    rule = "a" * 250 + ".com"
+    assert main.is_valid_rule(rule) is True


The rule length test doesn’t actually hit the stated boundary: long_rule = "a" * 256 + ".com" is 260 chars, and the “acceptable” case is 254 chars. If the intent is to cover boundary conditions, adjust the test data to exercise exactly 255 (allowed) and 256 (rejected) characters (and update the comments accordingly).

Copilot · 2026-02-21T11:24:21Z

tests/test_security_limits.py

+    """
+    Test that folder names exceeding the maximum length are rejected.
+    Current behavior: Accepts any length.
+    Expected behavior: Should reject length > 64.
+    """
+    # Create a name with 65 characters
+    long_name = "a" * 65
+
+    # This should return False after the fix, but currently returns True
+    # We assert False to confirm the "failure" (vulnerability presence) or "success" (fix verification)
+    assert main.is_valid_folder_name(long_name) is False
+


Several docstrings/comments mention “current behavior” and “currently returns True”, but once this PR is merged those statements will be false and can confuse future maintainers. Consider rewriting these tests to only describe the expected behavior being asserted.

Copilot · 2026-02-21T11:24:21Z

main.py

    Checks if a profile ID matches the expected format.

    Validates against PROFILE_ID_PATTERN and enforces maximum length of 64 characters.
    """
    if not PROFILE_ID_PATTERN.match(profile_id):
        return False
-    if len(profile_id) > 64:
+    if len(profile_id) > MAX_PROFILE_ID_LENGTH:
        return False


The docstring hard-codes “maximum length of 64 characters”, but the implementation now uses MAX_PROFILE_ID_LENGTH. To prevent drift if the constant changes, consider updating the docstring to reference the constant (or avoid embedding the specific number).

main.py

-            elif len(profile_id) > 64:
-                log.error("Invalid profile ID length (max 64 chars)")
+            elif len(profile_id) > MAX_PROFILE_ID_LENGTH:
+                log.error(f"Invalid profile ID length (max {MAX_PROFILE_ID_LENGTH} chars)")


tests/test_security_limits.py

@@ -0,0 +1,50 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,50 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,50 @@
+import pytest


tests/test_security_limits.py

+    long_name = "a" * 65
+
+    # This should return False after the fix, but currently returns True
+    # We assert False to confirm the "failure" (vulnerability presence) or "success" (fix verification)


main.py

-            elif len(profile_id) > 64:
-                log.error("Invalid profile ID length (max 64 chars)")
+            elif len(profile_id) > MAX_PROFILE_ID_LENGTH:
+                log.error(f"Invalid profile ID length (max {MAX_PROFILE_ID_LENGTH} chars)")


tests/test_security_limits.py

@@ -0,0 +1,50 @@
+import pytest


tests/test_security_limits.py

+
+    # This should return False after the fix, but currently returns True
+    # We assert False to confirm the "failure" (vulnerability presence) or "success" (fix verification)
+    assert main.is_valid_folder_name(long_name) is False


tests/test_security_limits.py

+def test_is_valid_folder_name_acceptable_length():
+    """Test that folder names within limit are accepted."""
+    name = "a" * 64
+    assert main.is_valid_folder_name(name) is True


tests/test_security_limits.py

+    long_rule = "a" * 256 + ".com"
+
+    # This should return False after the fix
+    assert main.is_valid_rule(long_rule) is False


tests/test_security_limits.py

+def test_is_valid_rule_acceptable_length():
+    """Test that rules within limit are accepted."""
+    rule = "a" * 250 + ".com"
+    assert main.is_valid_rule(rule) is True


tests/test_security_limits.py

+    """
+    # 65 chars
+    long_id = "a" * 65
+    assert main.validate_profile_id(long_id, log_errors=False) is False


tests/test_security_limits.py

+
+    # 64 chars
+    valid_id = "a" * 64
+    assert main.validate_profile_id(valid_id, log_errors=False) is True


tests/test_security_limits.py

@@ -0,0 +1,50 @@
+import pytest


tests/test_security_limits.py

+    long_name = "a" * 65
+
+    # This should return False after the fix, but currently returns True
+    # We assert False to confirm the "failure" (vulnerability presence) or "success" (fix verification)


tests/test_security_limits.py

@@ -0,0 +1,50 @@
+import pytest


gemini-code-assist

Code Review

The pull request effectively addresses a Denial of Service (DoS) vulnerability by introducing explicit length limits for folder names, rules, and profile IDs, adding constants, applying them in validation functions, and introducing new security tests. The documentation in .jules/sentinel.md has also been updated. However, a critical vulnerability remains as the newly created is_valid_rule function, which enforces the length limit for rules, is not utilized in the push_rules production code path, leaving the application still susceptible to DoS attacks via rule inputs.

gemini-code-assist · 2026-02-21T11:26:36Z

main.py

+    if len(rule) > MAX_RULE_LENGTH:
+        return False


The is_valid_rule function, which adds a length check for rule using MAX_RULE_LENGTH to prevent excessively long rule strings and address a Denial of Service (DoS) vulnerability, is currently not called in the production code. Specifically, the push_rules function (line 1967) bypasses this new length check by directly using RULE_PATTERN.match. This leaves the application vulnerable to DoS attacks from overly long rule inputs. To fully address this, push_rules should be updated to utilize is_valid_rule for rule validation (e.g., by changing line 1961 to match_rule = is_valid_rule).

gemini-code-assist · 2026-02-21T11:26:36Z

.jules/sentinel.md

+## 2026-10-24 - Missing Input Length Limits (DoS Risk)
+
+**Vulnerability:** The application accepted unlimited length strings for folder names and rules. While validation checked for dangerous characters, extremely long strings could cause Denial of Service (DoS) or buffer issues in downstream systems/APIs.
+
+**Learning:** Regex validation and character whitelisting are not enough; explicit length limits are required for complete input validation "Defense in Depth".
+
+**Prevention:** Define explicit maximum constants (e.g., `MAX_FOLDER_NAME_LENGTH = 64`, `MAX_RULE_LENGTH = 255`) and enforce them in validation functions (`is_valid_folder_name`, `is_valid_rule`).


The addition of this section to the sentinel.md file is a good practice for documenting security vulnerabilities and their fixes. It clearly outlines the vulnerability, the learning, and the prevention steps, which is valuable for future reference and knowledge sharing.

gemini-code-assist · 2026-02-21T11:26:36Z

main.py

+# Security: Input length limits
+MAX_FOLDER_NAME_LENGTH = 64
+MAX_RULE_LENGTH = 255
+MAX_PROFILE_ID_LENGTH = 64


Introducing constants for maximum lengths is a good practice. It centralizes these values, making them easier to manage and update. This also improves readability and maintainability compared to hardcoding magic numbers directly in the validation logic.

gemini-code-assist · 2026-02-21T11:26:36Z

tests/test_security_limits.py

+import pytest
+import main
+
+def test_is_valid_folder_name_length_limit():
+    """
+    Test that folder names exceeding the maximum length are rejected.
+    Current behavior: Accepts any length.
+    Expected behavior: Should reject length > 64.
+    """
+    # Create a name with 65 characters
+    long_name = "a" * 65
+
+    # This should return False after the fix, but currently returns True
+    # We assert False to confirm the "failure" (vulnerability presence) or "success" (fix verification)
+    assert main.is_valid_folder_name(long_name) is False
+
+def test_is_valid_folder_name_acceptable_length():
+    """Test that folder names within limit are accepted."""
+    name = "a" * 64
+    assert main.is_valid_folder_name(name) is True
+
+def test_is_valid_rule_length_limit():
+    """
+    Test that rules exceeding the maximum length are rejected.
+    Current behavior: Accepts any length (matching regex).
+    Expected behavior: Should reject length > 255.
+    """
+    # Create a rule with 256 characters (valid chars)
+    long_rule = "a" * 256 + ".com"
+
+    # This should return False after the fix
+    assert main.is_valid_rule(long_rule) is False
+
+def test_is_valid_rule_acceptable_length():
+    """Test that rules within limit are accepted."""
+    rule = "a" * 250 + ".com"
+    assert main.is_valid_rule(rule) is True
+
+def test_is_valid_profile_id_length_limit_constant():
+    """
+    Test that profile ID validation respects the length limit.
+    Note: This function already had a length check, we are just formalizing it with a constant.
+    """
+    # 65 chars
+    long_id = "a" * 65
+    assert main.validate_profile_id(long_id, log_errors=False) is False
+
+    # 64 chars
+    valid_id = "a" * 64
+    assert main.validate_profile_id(valid_id, log_errors=False) is True


The addition of test_security_limits.py is excellent. It provides dedicated tests for the newly introduced length limits, ensuring that the fixes are working as expected and preventing regressions. The tests cover boundary conditions for folder names, rules, and profile IDs, which is comprehensive.

🛡️ Sentinel: [MEDIUM] Add input length limits to prevent DoS

9302f0f

Co-authored-by: abhimehro <84992105+abhimehro@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 21, 2026 11:22

github-actions bot added the python label Feb 21, 2026

github-advanced-security bot found potential problems Feb 21, 2026

View reviewed changes

Copilot started reviewing on behalf of abhimehro February 21, 2026 11:22 View session

Copilot AI reviewed Feb 21, 2026

View reviewed changes

github-advanced-security bot found potential problems Feb 21, 2026

View reviewed changes

gemini-code-assist bot reviewed Feb 21, 2026

View reviewed changes

This was referenced Feb 28, 2026

🛡️ Sentinel: [CRITICAL] Fix syntax error in input validation #415

Closed

🛡️ Sentinel: Fix broken validation and add length limits #425

Closed

⚡ Bolt: Skip redundant DNS validation for cached blocklists #423

Closed

abhimehro merged commit 6756088 into main Feb 28, 2026
73 checks passed

abhimehro deleted the sentinel/input-length-limits-12467936797948403414 branch February 28, 2026 08:42

abhimehro mentioned this pull request Feb 28, 2026

⚡ Bolt: Optimize cache I/O and rule processing loop #413

Closed

Conversation

abhimehro commented Feb 21, 2026

Uh oh!

google-labs-jules bot commented Feb 21, 2026

Uh oh!

trunk-io bot commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 21, 2026

Uh oh!

gemini-code-assist bot commented Feb 21, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Check warning

Check warning

Check warning

Check warning

Check warning

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check warning

Check warning

Check notice

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

trunk-io bot commented Feb 21, 2026 •

edited

Loading