Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement serialization protection via magic #169

Merged
merged 2 commits into from
Dec 18, 2024
Merged

Conversation

JustusAdam
Copy link
Collaborator

@JustusAdam JustusAdam commented Dec 18, 2024

What Changed?

This adds a u64 magic number to the beginning of the output artifact from paralegal-flow which is verified upon loading the artifact.

The magic number is a hash of the modification dates of all files in the paralegal-spdg crate.

Why Does It Need To?

At present there is no protection that the format expected by a policy application conforms to the format written by the flow analyzer. Specifically the analyzer may be compiled against an older or newer version of paralegal-spdg. In such cases the derived serde implementation for the output artifact may differ. bincode, the serialization library we use, does not offer protection against this case, leading to out-of-memory errors and memory leaks in deserialization.

The magic hash added detects this version mismatch and reports it.

Checklist

  • Above description has been filled out so that upon quash merge we have a
    good record of what changed.
  • New functions, methods, types are documented. Old documentation is updated
    if necessary
  • Documentation in Notion has been updated
  • Tests for new behaviors are provided
    • New test suites (if any) ave been added to the CI tests (in
      .github/workflows/rust.yml) either as compiler test or integration test.
      Or justification for their omission from CI has been provided in this PR
      description.

@JustusAdam JustusAdam merged commit 52a64bd into main Dec 18, 2024
4 checks passed
@JustusAdam JustusAdam deleted the magic-for-artifact branch December 18, 2024 21:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant