Skip to content

fix(unreal): Don't accept unbounded custom nodes in RuntimeProperties - #1072

Open
klochek wants to merge 4 commits into
masterfrom
christopherklochek/ingest-1196-security-report-one-anonymous-request-oom-kills-relay
Open

klochek wants to merge 4 commits into
masterfrom
christopherklochek/ingest-1196-security-report-one-anonymous-request-oom-kills-relay

Conversation

@klochek

@klochek klochek commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@klochek
klochek requested a review from a team as a code owner September 21, 2026 14:38
@linear-code

linear-code Bot commented Sep 21, 2026

Copy link
Copy Markdown

INGEST-1196

Comment thread symbolic-unreal/src/context.rs
@klochek
klochek force-pushed the christopherklochek/ingest-1196-security-report-one-anonymous-request-oom-kills-relay branch from 8345905 to 2b97795 Compare September 21, 2026 14:51
Comment thread symbolic-unreal/src/context.rs Outdated

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2b97795. Configure here.

Comment thread symbolic-unreal/src/context.rs Outdated

if dest_data.len() > MAX_DATA_BAG_NODES {
break;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Data bag limit off by one

Low Severity

load_data_bag inserts first and then breaks when dest_data.len() is greater than MAX_DATA_BAG_NODES, so the map can hold 100,001 entries instead of the intended 100,000. The RuntimeProperties custom-node path compares before insert and stays within the cap.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 2b97795. Configure here.

@tobias-wilfert

Copy link
Copy Markdown
Member

I think adding a test, if possible, would be nice. Also left a comment on the internal ticket.

Comment thread symbolic-unreal/src/context.rs Outdated
let value = child.value::<String>()?.unwrap_or_default();
dest_data.insert(name, value);

if dest_data.len() > MAX_DATA_BAG_NODES {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this check can be moved to the start of the loop.

@klochek
klochek requested a review from loewenheim September 22, 2026 18:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants