Repository navigation
fix(security): bound Parquet RLE expansion - #235
Conversation
Reject hybrid RLE runs that exceed the decoded value count before the dependency can extend its output array.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 46 minutes. View limit details
 |
| Layer / File(s) | Summary |
|---|---|
Install-time decoder patch webapp/patch-hyparquet-rle.mjs, webapp/package.json |
The patch script requires Hyparquet version 1.26.2 and replaces the expected decoder snippet with checks for zero or oversized run counts. The postinstall script runs this patch. |
Malformed Parquet upload validation webapp/src/features/race/lib/uploadParse.test.tsx |
Tests verify that an oversized RLE run throws without changing the output array, that parsing the malformed fixture rejects, and that the prior dataset remains in the store after the upload error. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Merge Risk: 
d65c0
-
The Docker build invokes a patch script that is not yet present in the image, risking a failed image build. Copy the script before installing dependencies before merging.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title "fix(security): bound Parquet RLE expansion" matches the main change. The PR adds a version-checked postinstall patch to Hyparquet's RLE decoder. The patch rejects zero-length or oversized R… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "fix(security): bound Parquet RLE expansion" matches the main change. The PR adds a version-checked postinstall patch to Hyparquet's RLE decoder. The patch rejects zero-length or oversized RLE runs before they expand the output. The title names the security fix and the affected decoder path. It is short and single-sentence, and it uses a conventional commit prefix.
-
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
Finishing Touches
-
Generate docstrings
-
- Commit to this branch
- Create a new PR
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Fail installation if both patched and vulnerable decoder blocks are present.
The client-side Parquet importer preflights page metadata, but Hyparquet 1.26.2 expands an RLE run beyond the declared page value count. A valid 391-byte Parquet file declaring one row can therefore make the browser allocate and write millions of values.
This adds a version-checked postinstall patch that rejects a zero-length or oversized RLE run before the dependency writes to its output array. It applies with both npm and Bun and fails installation if Hyparquet changes and the patch no longer matches.
Related to F1-StratLab issue #227 D2. The issue remains open because its other phases are incomplete.
Verification
Summary by CodeRabbit