Conversation
Enforce a maximum length of 100,000 characters for mathematical expressions in `ArenaMathParser.Tokenize` to prevent Denial of Service attacks via unbounded memory allocation. Added a test suite to verify the fix. Co-authored-by: myarichuk <1473701+myarichuk@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🎯 What: Enforced a maximum length (100,000 characters) for mathematical expressions in
ArenaMathParser.Tokenize.🛡️ Solution: Added a
MaxExpressionLengthconstant and a check at the beginning of theTokenizemethod to throw aSyntaxErrorExceptionif the input length exceeds this limit. This prevents any allocations for excessively large, malicious payloads. Also added a new test projecttests/SimpleMathParser.Testswith test cases to verify the enforcement of this limit.PR created automatically by Jules for task 7111314682171355679 started by @myarichuk