Bound Dockerfile and TypeScript JSON parser budgets (#3346)

* Fix Dockerfile JSON form extraction budgets (#3211)

* Cover TypeScript path alias target budgets (#3212)

Author: Widthdom

changelog.d/unreleased/3211.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3211
+affected:
+  - src/CodeIndex/Indexer/Symbols/SymbolExtractor.Dockerfile.cs
+  - tests/CodeIndex.Tests/SymbolExtractorTests.cs
+---
+
+## English
+
+- **Dockerfile JSON-form symbol extraction now enforces item and string budgets (#3211)** — `VOLUME`, `SHELL`, `COPY`, and `ADD` JSON-form parsing now caps processed array entries and string lengths in addition to the existing JSON depth limit.
+
+## 日本語
+
+- **Dockerfile JSON form の symbol extraction が item 数と文字列長の上限を適用するようになりました (#3211)** — `VOLUME`、`SHELL`、`COPY`、`ADD` の JSON form parse は、既存の JSON depth 上限に加えて、処理する配列要素数と文字列長にも上限を適用します。

changelog.d/unreleased/3212.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 3212
+affected:
+  - src/CodeIndex/Indexer/Symbols/SymbolExtractor.TypeScriptPathAliases.cs
+  - tests/CodeIndex.Tests/SymbolExtractorTests.cs
+---
+
+## English
+
+- **TypeScript path alias parsing now has explicit JSON and alias-map budgets tied to #3212** — `tsconfig.json` / `jsconfig.json` path alias extraction is covered for JSON depth, alias rule counts, per-rule and total targets, and overlong pattern/target strings.
+
+## 日本語
+
+- **TypeScript path alias parse が #3212 の JSON / alias map 予算を明示的に扱うようになりました** — `tsconfig.json` / `jsconfig.json` の path alias extraction は、JSON depth、alias rule 数、rule ごとおよび合計 target 数、過長な pattern / target 文字列の上限をカバーします。

src/CodeIndex/Indexer/Symbols/SymbolExtractor.Dockerfile.cs

@@ -7,6 +7,8 @@ namespace CodeIndex.Indexer;
 public static partial class SymbolExtractor
 {
     internal const int DockerfileJsonFormMaxDepth = 8;
+    internal const int DockerfileJsonFormMaxItems = 128;
+    internal const int DockerfileJsonFormMaxStringLength = 4096;
     private static readonly JsonDocumentOptions DockerfileJsonFormDocumentOptions = new()
     {
         MaxDepth = DockerfileJsonFormMaxDepth,
@@ -313,13 +315,14 @@ private static void AddDockerfileJsonVolumeSymbols(
             if (document.RootElement.ValueKind != JsonValueKind.Array)
                 return;
 
+            var itemCount = 0;
             foreach (var item in document.RootElement.EnumerateArray())
             {
-                if (item.ValueKind != JsonValueKind.String)
-                    continue;
+                if (itemCount >= DockerfileJsonFormMaxItems)
+                    break;
+                itemCount++;
 
-                var name = item.GetString();
-                if (string.IsNullOrWhiteSpace(name))
+                if (!TryGetDockerfileJsonFormString(item, out var name))
                     continue;
 
                 AddSymbolRecord(
@@ -344,6 +347,23 @@ private static void AddDockerfileJsonVolumeSymbols(
         }
     }
 
+    private static bool TryGetDockerfileJsonFormString(JsonElement item, out string value)
+    {
+        value = string.Empty;
+        if (item.ValueKind != JsonValueKind.String)
+            return false;
+
+        var text = item.GetString();
+        if (string.IsNullOrWhiteSpace(text)
+            || text.Length > DockerfileJsonFormMaxStringLength)
+        {
+            return false;
+        }
+
+        value = text;
+        return true;
+    }
+
     private static void AddDockerfileNamedStageBaseImageSymbol(
         long fileId,
         string line,
@@ -400,11 +420,7 @@ private static void AddDockerfileShellSymbol(
                 return;
 
             var first = document.RootElement.EnumerateArray().FirstOrDefault();
-            if (first.ValueKind != JsonValueKind.String)
-                return;
-
-            var name = first.GetString();
-            if (string.IsNullOrWhiteSpace(name))
+            if (!TryGetDockerfileJsonFormString(first, out var name))
                 return;
 
             AddSymbolRecord(
@@ -531,11 +547,14 @@ private static bool TryGetDockerfileInstructionBody(string line, string instruct
             var count = 0;
             foreach (var item in document.RootElement.EnumerateArray())
             {
-                if (item.ValueKind != JsonValueKind.String)
+                if (count >= DockerfileJsonFormMaxItems)
                     return null;
-
-                last = item.GetString();
                 count++;
+
+                if (!TryGetDockerfileJsonFormString(item, out var value))
+                    return null;
+
+                last = value;
             }
 
             return count >= 2 ? last : null;

tests/CodeIndex.Tests/SymbolExtractorTests.cs

@@ -15291,6 +15291,75 @@ public void Extract_Dockerfile_JsonFormsIgnorePayloadsBeyondParserDepthLimit(str
         Assert.Empty(symbols);
     }
 
+    [Fact]
+    public void Extract_Dockerfile_JsonVolumeCapsArrayItems()
+    {
+        var maxItems = SymbolExtractor.DockerfileJsonFormMaxItems;
+        var items = Enumerable.Range(0, maxItems)
+            .Select(i => $"/vol{i}")
+            .Concat(["/too-many"]);
+        var content = "VOLUME [" + string.Join(", ", items.Select(item => JsonSerializer.Serialize(item))) + "]\n";
+
+        var symbols = SymbolExtractor.Extract(1, "dockerfile", content);
+
+        Assert.Equal(maxItems, symbols.Count);
+        Assert.Contains(symbols, s => s.Kind == "property" && s.Name == "/vol0");
+        Assert.Contains(symbols, s => s.Kind == "property" && s.Name == "/vol" + (maxItems - 1));
+        Assert.DoesNotContain(symbols, s => s.Kind == "property" && s.Name == "/too-many");
+    }
+
+    [Fact]
+    public void Extract_Dockerfile_JsonVolumeSkipsOverlongStrings()
+    {
+        var tooLong = "/" + new string('v', SymbolExtractor.DockerfileJsonFormMaxStringLength);
+        var content = "VOLUME [" + JsonSerializer.Serialize(tooLong) + ", \"/ok\"]\n";
+
+        var symbols = SymbolExtractor.Extract(1, "dockerfile", content);
+
+        Assert.Contains(symbols, s => s.Kind == "property" && s.Name == "/ok");
+        Assert.DoesNotContain(symbols, s => s.Kind == "property" && s.Name == tooLong);
+        Assert.Single(symbols);
+    }
+
+    [Fact]
+    public void Extract_Dockerfile_JsonShellSkipsOverlongExecutable()
+    {
+        var tooLong = "/" + new string('s', SymbolExtractor.DockerfileJsonFormMaxStringLength);
+        var content = "SHELL [" + JsonSerializer.Serialize(tooLong) + ", \"-c\"]\n";
+
+        var symbols = SymbolExtractor.Extract(1, "dockerfile", content);
+
+        Assert.Empty(symbols);
+    }
+
+    [Theory]
+    [InlineData("COPY")]
+    [InlineData("ADD")]
+    public void Extract_Dockerfile_JsonCopyAddSkipOverlongDestinations(string instruction)
+    {
+        var tooLong = "/" + new string('d', SymbolExtractor.DockerfileJsonFormMaxStringLength);
+        var content = instruction + " [\"source\", " + JsonSerializer.Serialize(tooLong) + "]\n";
+
+        var symbols = SymbolExtractor.Extract(1, "dockerfile", content);
+
+        Assert.Empty(symbols);
+    }
+
+    [Theory]
+    [InlineData("COPY")]
+    [InlineData("ADD")]
+    public void Extract_Dockerfile_JsonCopyAddSkipArraysBeyondItemBudget(string instruction)
+    {
+        var maxItems = SymbolExtractor.DockerfileJsonFormMaxItems;
+        var items = Enumerable.Range(0, maxItems + 1)
+            .Select(i => $"/src{i}");
+        var content = instruction + " [" + string.Join(", ", items.Select(item => JsonSerializer.Serialize(item))) + "]\n";
+
+        var symbols = SymbolExtractor.Extract(1, "dockerfile", content);
+
+        Assert.Empty(symbols);
+    }
+
     [Fact]
     public void Extract_Dockerfile_DetectsOnbuildCopyDestinationPathSymbols()
     {
@@ -18269,6 +18338,59 @@ public void Extract_TypeScript_ExcessiveTsconfigPathAliasTargetsTruncatesWithWar
         }
     }
 
+    [Fact]
+    public void Extract_TypeScript_ExcessiveTsconfigPathAliasTotalTargetsTruncatesWithWarning()
+    {
+        var projectRoot = TestProjectHelper.CreateTempProject("tsconfig_alias_total_targets_symbols");
+        try
+        {
+            var maxTargetsPerRule = GetSymbolExtractorIntConstant("MaxTypeScriptPathAliasTargetsPerRule");
+            var maxTotalTargets = GetSymbolExtractorIntConstant("MaxTypeScriptPathAliasTotalTargets");
+            var paths = new StringBuilder();
+            var remainingTargets = maxTotalTargets;
+            var rule = 0;
+            while (remainingTargets > 0)
+            {
+                if (paths.Length > 0)
+                    paths.Append(',');
+
+                var targetsForRule = Math.Min(maxTargetsPerRule, remainingTargets);
+                paths.Append('"').Append("@skip").Append(rule).Append("/*").Append("\":[");
+                for (var target = 0; target < targetsForRule; target++)
+                {
+                    if (target > 0)
+                        paths.Append(',');
+                    paths.Append('"').Append("missing").Append(rule).Append('_').Append(target).Append("/*").Append('"');
+                }
+
+                paths.Append(']');
+                remainingTargets -= targetsForRule;
+                rule++;
+            }
+
+            paths.Append(",\"@hit/*\":[\"src/*\"]");
+
+            WriteFile(
+                projectRoot,
+                "tsconfig.json",
+                "{\"compilerOptions\":{\"baseUrl\":\".\",\"paths\":{" + paths + "}}}");
+            WriteFile(projectRoot, "src/Button.ts", "export const Button = 1;\n");
+            var sourcePath = WriteFile(projectRoot, "src/main.ts", "import { Button } from \"@hit/Button\";\n");
+
+            List<SymbolRecord> symbols = [];
+            var stderr = ConsoleCapture.CaptureError(() =>
+                symbols = SymbolExtractor.Extract(1, "typescript", File.ReadAllText(sourcePath), sourcePath));
+
+            Assert.Contains(symbols, s => s.Kind == "import" && s.Name == "@hit/Button");
+            Assert.DoesNotContain(symbols, s => s.Kind == "import" && s.Name == "src/Button.ts");
+            Assert.Contains("Truncated TypeScript path alias targets", stderr, StringComparison.Ordinal);
+        }
+        finally
+        {
+            TestProjectHelper.DeleteDirectory(projectRoot);
+        }
+    }
+
     [Fact]
     public void Extract_TypeScript_OverlongTsconfigPathAliasStringsAreIgnoredWithBoundedWarning()
     {