feat: harden input parsing with size caps, depth limits, and filesystem validation - #13

Merged

Arkptz merged 12 commits into

mainfrom

feat/input-hardening

Apr 22, 2026

Commits on Apr 22, 2026

feat(error): add typed variants for parse and input limits
Arkptz
committed
7c7301e
feat(tnetstring): cap payload size at 256 MiB
Arkptz
committed
34c01cf
feat(tnetstring): enforce 256-level recursion depth limit
Arkptz
committed
3841252
feat(schema): enforce 64-level JSON recursion depth limit
Arkptz
committed
e157940
perf(builder): replace custom glob matcher with globset
Arkptz
committed
97864db
feat(reader): reject symlinks, non-regular files, and oversized inputs
Arkptz
committed
428125a
feat(cli): expose --max-input-size, --max-payload-size, --max-depth, --max-body-size, --allow-symlinks
Arkptz
committed
4814171
perf(har): bound format-detection read to 4 KiB
Arkptz
committed
cfa1397
feat(path_matching): validate path parameter identifiers
Arkptz
committed
a57e3d6
test(security): cover symlink, FIFO, and oversize input rejection
Arkptz
committed
476e25c
chore: update Cargo.lock for globset dependency
Arkptz
committed
a7423d2
fix(test): gate symlink and FIFO tests behind cfg(unix)
Arkptz
committed
de268f9