🛡️ Sentinel: Fix broken validation and add length limits by abhimehro · Pull Request #425 · abhimehro/ctrld-sync

abhimehro · 2026-02-25T10:43:03Z

🚨 Severity: HIGH
💡 Vulnerability:

validate_folder_data contained invalid syntax, causing the application to crash or fail validation silently (Availability).
Input validation lacked length limits for folder names, IDs, and rules, allowing potential DoS via memory exhaustion or large payloads.
push_rules optimization bypassed the standard is_valid_rule check.

🎯 Impact:

Application instability (crash on certain inputs).
Potential Denial of Service (DoS) via large inputs.

🔧 Fix:

Repaired syntax error in validate_folder_data and restored proper validation logic.
Added length limits: Folder IDs/Names (64 chars), Rules (255 chars).
Updated push_rules to respect the new length limit inline.

✅ Verification:

Added tests/test_security_limits.py to verify length constraints.
Ran full test suite (172 tests passed).

PR created automatically by Jules for task 11441188995627958754 started by @abhimehro

- Fixed syntax error in `validate_folder_data` that prevented execution. - Added input length limits to prevent DoS: - Folder IDs: max 64 chars - Folder Names: max 64 chars - Rules: max 255 chars - Updated `push_rules` to enforce rule length limit (previously bypassed standard validation). - Added tests in `tests/test_security_limits.py`. Co-authored-by: abhimehro <84992105+abhimehro@users.noreply.github.com>

google-labs-jules · 2026-02-25T10:43:04Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

trunk-io · 2026-02-25T10:43:06Z

Merging to main in this repository is managed by Trunk.

To merge this pull request, check the box to the left or comment /trunk merge below.

github-actions · 2026-02-25T10:43:13Z

👋 Development Partner is reviewing this PR. Will provide feedback shortly.

gemini-code-assist · 2026-02-25T10:43:19Z

Summary of Changes

Hello @abhimehro, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses critical security vulnerabilities by fixing a broken validation function and implementing comprehensive length limits across various input fields. The changes enhance application stability, prevent potential Denial of Service attacks, and ensure that security controls are consistently applied, even in optimized code paths. The introduction of new tests verifies the effectiveness of these security improvements.

Highlights

Validation Fix: Repaired a critical syntax error in validate_folder_data that was causing silent validation failures or application crashes, restoring proper data validation.
Length Limits Implemented: Introduced strict length limits for folder IDs (64 characters), folder names (64 characters), and rules (255 characters) to mitigate potential Denial of Service (DoS) attacks via memory exhaustion or large payloads.
Security Bypass Prevention: Updated the push_rules function to explicitly incorporate the new rule length limit, preventing a potential security control bypass that could occur due to an optimized, inline regex check.
New Test Coverage: Added a new test file, tests/test_security_limits.py, to specifically verify the newly implemented length constraints for folder names, IDs, and rules.

Changelog

.jules/sentinel.md
- Documented a new security learning entry regarding how performance optimizations can inadvertently bypass security controls if not carefully managed.
main.py
- Enforced a maximum length of 64 characters for folder IDs within the validate_folder_id function.
- Introduced a maximum length of 255 characters for rules in is_valid_rule to prevent potential DoS attacks.
- Applied a maximum length of 64 characters for folder names in the is_valid_folder_name function.
- Fixed syntax errors and corrected indentation in validate_folder_data to ensure proper validation of rule groups and individual rules.
- Integrated the 255-character length check directly into push_rules to prevent security bypasses and ensure consistent validation.
tests/test_security_limits.py
- Added test_is_valid_folder_name_limits to verify folder name length validation.
- Added test_is_valid_rule_limits to verify rule length validation.
- Added test_validate_folder_id_limits to verify folder ID length validation.

Activity

PR created automatically by Jules for task 11441188995627958754.
Full test suite (172 tests) was run and passed, verifying the changes.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

tests/test_security_limits.py

+
+def test_is_valid_folder_name_limits():
+    # Test length limit: 64 characters (pass)
+    assert main.is_valid_folder_name("a" * 64) is True


tests/test_security_limits.py

+    assert main.is_valid_folder_name("a" * 64) is True
+
+    # Test length limit: 65 characters (fail)
+    assert main.is_valid_folder_name("a" * 65) is False


tests/test_security_limits.py

+def test_is_valid_rule_limits():
+    # Test length limit: 255 characters (pass)
+    # Using 'a' which matches the regex ^[a-zA-Z0-9.\-_:*/@]+$
+    assert main.is_valid_rule("a" * 255) is True


tests/test_security_limits.py

+    assert main.is_valid_rule("a" * 255) is True
+
+    # Test length limit: 256 characters (fail)
+    assert main.is_valid_rule("a" * 256) is False


tests/test_security_limits.py

+def test_validate_folder_id_limits():
+    # Test length limit: 64 characters (pass)
+    # Using 'a' which matches ^[a-zA-Z0-9_.-]+$
+    assert main.validate_folder_id("a" * 64) is True


tests/test_security_limits.py

+
+    # Test length limit: 65 characters (fail)
+    # We pass log_errors=False to avoid cluttering output
+    assert main.validate_folder_id("a" * 65, log_errors=False) is False


main.py

        return False
+    if len(folder_id) > 64:
+        if log_errors:
+            log.error(f"Invalid folder ID length (max 64): {len(folder_id)}")


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest
+from unittest.mock import MagicMock, patch


main.py

tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest
+from unittest.mock import MagicMock, patch


tests/test_security_limits.py

+from unittest.mock import MagicMock, patch
+import main
+
+def test_is_valid_folder_name_limits():


tests/test_security_limits.py

+    # Test length limit: 65 characters (fail)
+    assert main.is_valid_folder_name("a" * 65) is False
+
+def test_is_valid_rule_limits():


tests/test_security_limits.py

+    # Test length limit: 256 characters (fail)
+    assert main.is_valid_rule("a" * 256) is False
+
+def test_validate_folder_id_limits():


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest
+from unittest.mock import MagicMock, patch


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest
+from unittest.mock import MagicMock, patch


tests/test_security_limits.py

+
+def test_is_valid_folder_name_limits():
+    # Test length limit: 64 characters (pass)
+    assert main.is_valid_folder_name("a" * 64) is True


tests/test_security_limits.py

+    assert main.is_valid_folder_name("a" * 64) is True
+
+    # Test length limit: 65 characters (fail)
+    assert main.is_valid_folder_name("a" * 65) is False


tests/test_security_limits.py

+def test_is_valid_rule_limits():
+    # Test length limit: 255 characters (pass)
+    # Using 'a' which matches the regex ^[a-zA-Z0-9.\-_:*/@]+$
+    assert main.is_valid_rule("a" * 255) is True


tests/test_security_limits.py

+    assert main.is_valid_rule("a" * 255) is True
+
+    # Test length limit: 256 characters (fail)
+    assert main.is_valid_rule("a" * 256) is False


tests/test_security_limits.py

+def test_validate_folder_id_limits():
+    # Test length limit: 64 characters (pass)
+    # Using 'a' which matches ^[a-zA-Z0-9_.-]+$
+    assert main.validate_folder_id("a" * 64) is True


tests/test_security_limits.py

+
+    # Test length limit: 65 characters (fail)
+    # We pass log_errors=False to avoid cluttering output
+    assert main.validate_folder_id("a" * 65, log_errors=False) is False


main.py

tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest
+from unittest.mock import MagicMock, patch


tests/test_security_limits.py

+from unittest.mock import MagicMock, patch
+import main
+
+def test_is_valid_folder_name_limits():


tests/test_security_limits.py

+    # Test length limit: 65 characters (fail)
+    assert main.is_valid_folder_name("a" * 65) is False
+
+def test_is_valid_rule_limits():


tests/test_security_limits.py

+    # Test length limit: 256 characters (fail)
+    assert main.is_valid_rule("a" * 256) is False
+
+def test_validate_folder_id_limits():


main.py

        return False
+    if len(folder_id) > 64:
+        if log_errors:
+            log.error(f"Invalid folder ID length (max 64): {len(folder_id)}")


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest
+from unittest.mock import MagicMock, patch


tests/test_security_limits.py

@@ -0,0 +1,27 @@
+import pytest
+from unittest.mock import MagicMock, patch


Copilot

Pull request overview

This PR addresses validation-related security and stability issues by repairing validate_folder_data syntax/logic, adding input length limits to reduce DoS risk, and extending test coverage to enforce these limits.

Changes:

Add max-length constraints for folder IDs/names (64) and rules (255) in validation helpers.
Fix broken validate_folder_data logic and ensure it returns True on success.
Add a new security-focused test module covering the new length limits.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
`main.py`	Adds length limits to validators, fixes `validate_folder_data`, and updates `push_rules` filtering logic.
`tests/test_security_limits.py`	Introduces tests that assert folder/rule length constraints are enforced.
`.jules/sentinel.md`	Documents the optimization/validation drift risk as a Sentinel entry.

Copilot · 2026-02-25T10:49:53Z

tests/test_security_limits.py

+import pytest
+from unittest.mock import MagicMock, patch


pytest, MagicMock, and patch are imported but not used in this test module. Removing unused imports will keep the test file minimal and avoid implying mocks/fixtures are required here.

Suggested change

import pytest

from unittest.mock import MagicMock, patch

Copilot · 2026-02-25T10:49:54Z

main.py

    # Optimization 2: Inline regex match and check existence
    # Using a local reference to the match method avoids function call overhead
    # in the hot loop. This provides a measurable speedup for large lists.
    match_rule = RULE_PATTERN.match

    for h in unique_hostnames:
        if h in existing_rules:
            continue

-        if not match_rule(h):
+        # Enforce max length (255) and regex pattern
+        if len(h) > 255 or not match_rule(h):


push_rules still duplicates the canonical rule-validation logic (length + RULE_PATTERN.match) instead of reusing is_valid_rule. This can drift again if is_valid_rule gains additional checks; consider calling is_valid_rule(h) (optionally via a local alias for performance) and/or centralizing the max-length value in a shared constant used by both paths.

gemini-code-assist

Code Review

This pull request effectively addresses several security vulnerabilities by fixing broken validation logic in validate_folder_data and introducing much-needed length limits for various inputs to prevent potential Denial of Service attacks. The changes are well-documented and include new tests to verify the added constraints. My feedback focuses on improving the long-term maintainability of these new security limits by suggesting the use of named constants instead of hardcoded 'magic numbers', which will make the code safer and easier to manage.

gemini-code-assist · 2026-02-25T10:50:40Z

main.py

    """Validates folder ID (PK) format to prevent path traversal."""
    if not folder_id:
        return False
+    if len(folder_id) > 64:


The value 64 is used as a maximum length for folder IDs here, and also for folder names (is_valid_folder_name) and profile IDs (is_valid_profile_id_format). To improve maintainability and ensure these security-related limits are consistent, consider defining a module-level constant (e.g., MAX_ID_LENGTH = 64) and using it in all relevant validation functions.

gemini-code-assist · 2026-02-25T10:50:40Z

main.py

        return False

+    # Enforce max length to prevent DoS
+    if len(rule) > 255:


The maximum rule length 255 is hardcoded here and also in push_rules. To prevent potential drift between this canonical validation function and the inlined performance optimization (as noted in .jules/sentinel.md), it's best to define this value as a module-level constant (e.g., MAX_RULE_LENGTH = 255) and use it in both places. This will make the code safer and easier to maintain.

gemini-code-assist · 2026-02-25T10:50:40Z

main.py

        return False

+    # Enforce max length to prevent DoS (matching profile ID limit)
+    if len(name) > 64:


The value 64 is used as a maximum length here and in other validation functions. To improve maintainability and ensure these security-related limits are consistent, consider defining a module-level constant (e.g., MAX_NAME_LENGTH = 64) and using it across all relevant functions.

gemini-code-assist · 2026-02-25T10:50:40Z

main.py


-        if not match_rule(h):
+        # Enforce max length (255) and regex pattern
+        if len(h) > 255 or not match_rule(h):


The maximum rule length 255 is hardcoded here, duplicating the value from is_valid_rule. To prevent potential logic drift between this optimized path and the canonical validation function (a risk highlighted in .jules/sentinel.md), it would be safer to use a shared module-level constant (e.g., MAX_RULE_LENGTH = 255) in both places.

abhimehro · 2026-02-28T08:38:32Z

🤖 Automated PR Review — Closing as duplicate

This combines the syntax fix with input length limits. #412 already provides dedicated input length limits against DoS, and the syntax fix should be applied cleanly to main without bundling. Closing as superseded by #412.

google-labs-jules · 2026-02-28T08:39:16Z

🤖 Automated PR Review — Closing as duplicate

This combines the syntax fix with input length limits. #412 already provides dedicated input length limits against DoS, and the syntax fix should be applied cleanly to main without bundling. Closing as superseded by #412.

Understood. Acknowledging that this work is superseded by #412 and stopping work on this task.

Copilot AI review requested due to automatic review settings February 25, 2026 10:43

github-actions bot added the python label Feb 25, 2026

github-advanced-security bot found potential problems Feb 25, 2026

View reviewed changes

Copilot started reviewing on behalf of abhimehro February 25, 2026 10:43 View session

github-advanced-security bot found potential problems Feb 25, 2026

View reviewed changes

Copilot AI reviewed Feb 25, 2026

View reviewed changes

gemini-code-assist bot reviewed Feb 25, 2026

View reviewed changes

abhimehro closed this Feb 28, 2026

		@@ -0,0 +1,27 @@
		import pytest
		from unittest.mock import MagicMock, patch

Conversation

abhimehro commented Feb 25, 2026

Uh oh!

google-labs-jules bot commented Feb 25, 2026

Uh oh!

trunk-io bot commented Feb 25, 2026

Uh oh!

github-actions bot commented Feb 25, 2026

Uh oh!

gemini-code-assist bot commented Feb 25, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check notice

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check notice

Check notice

Check notice

Check notice

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

abhimehro commented Feb 28, 2026

Uh oh!

google-labs-jules bot commented Feb 28, 2026

Uh oh!