mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-11-12 15:37:04 +09:00
rUv
6778628e9e
Part 1 — Security fix (LOW/MED):
v3/@claude-flow/cli/src/memory/embedding-quantization.ts
decodeEmbedding() did not validate the dims field from the blob header
against the actual buffer size. A crafted inline: blob with a large
dims value (e.g. 999999) would silently read undefined beyond the
buffer end, producing NaN in the result Float32Array, and a dims >
~16M would trigger a multi-GB Float32Array allocation (DoS). Added:
- Minimum header length guard (raw.byteLength < 16 → null)
- dims=0 rejection
- dims > 8192 allocation cap (all production models are ≤8192-dim)
- raw.byteLength < 16 + dims rejection (truncated payload)
Part 2 — CI guard (ADR-125 / ADR-130):
scripts/audit-env-var-precedence.mjs (new)
.github/workflows/v3-ci.yml (wired into plugin-package-audit)
Scans CLAUDE_FLOW_* / RUFLO_* env var reads in v3/cli/src + plugins/
for missing CLI-flag precedence documentation. Prevents future
contributors from adding an env var that silently ignores an explicit
--flag. Fails closed (exit 1). Existing escape-hatch vars (CI knobs,
credentials, process-internal signals) are allow-listed with comments.
All three existing audit guards confirmed strict (no continue-on-error):
audit-wrapper-dep-ranges.mjs (#2127)
audit-plugin-hooks-cross-platform.mjs (#2132)
audit-env-var-precedence.mjs (new, ADR-125/130)
Test baseline: 1998 passing (pre-existing failures unrelated to this PR).