From 95730a3c11998f8cc5e93b04b56acc56ebe335da Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Thu, 5 Nov 2026 04:06:23 +0000 Subject: [PATCH] Record authentication response budget decision --- docs/roadmap/audit/catalog.md | 64 ++++++++++++++++++++--------------- 1 file changed, 36 insertions(+), 28 deletions(-) diff --git a/docs/roadmap/audit/catalog.md b/docs/roadmap/audit/catalog.md index 7d3d614..40256ef 100644 --- a/docs/roadmap/audit/catalog.md +++ b/docs/roadmap/audit/catalog.md @@ -30,9 +30,11 @@ Sources: [Security 1](07-security.md#1-the-audited-go-toolchain-predates-applica **Confirmed resource/security defect.** Authentication diagnostics read a successful upstream body with unbounded `io.ReadAll`. A deadline does not bound -the bytes a fast server can supply. Introduce finite response consumption and -clean closure, with an explicit choice of byte budget and overflow reporting. -Overflow should not be interpreted as proof of rejected authentication. +the bytes a fast server can supply. +[Decision 3](#decision-3-authentication-response-budget-and-overflow-outcome) +selects a fixed 1 MiB internal constant and explicit overflow diagnostics, with +credential acceptance unknown. Implementation remains pending. Overflow should +not be interpreted as proof of rejected authentication. Relocating the provider adapter in entry 26 would not itself fix this defect. Sources: [Resources 1](05-resources.md#1-authentication-diagnostics-read-an-unbounded-upstream-body), @@ -515,6 +517,37 @@ in-document references, including recursion where otherwise supported. Update schema documentation and release notes, and simplify the shared compilation work in finding 21 accordingly. This record does not itself implement the change. +### Decision 3: Authentication Response Budget And Overflow Outcome + +**Related findings:** [2](#2-bound-authentication-probe-response-consumption) +and [26](#26-move-openrouter-authentication-protocol-details-into-its-adapter). + +**Status:** Accepted; implementation pending. + +**Decision:** Bound the authentication protocol's response body to 1 MiB +(1,048,576 bytes), defined as a named internal constant. This is a generous +practical processing allowance, not an upstream protocol limit. Do not add a +public configuration option now; keep the value centralized so a future option +can be introduced if needed. This limit does not apply to inference responses +or establish an application deadline. + +Enforce the budget against bytes actually read, regardless of declared content +length. Detect overflow, stop reading, and close without unbounded draining. +Report an explicit response-limit diagnostic with credential acceptance unknown, +retaining independently collected HTTP status and timing information. Overflow +is neither evidence of rejected credentials nor proof of malformed JSON. The +consuming application decides what to do with the diagnostic. + +**Alternative considered:** A caller-configurable budget with a finite default +would accommodate unusual deployments, but adds public configuration without a +current demonstrated need. Reconsider if such a need arises. + +**Remediation follow-through:** Add focused boundary and overflow coverage, +including missing or inaccurate content lengths. Represent overflow explicitly +in the diagnostic report and update its owning documentation. Keep this fix +independent of adapter relocation so architectural cleanup does not delay the +resource remedy. This record does not itself implement the change. + ## Open Decisions Work through the remaining decisions below in order, retaining their original @@ -524,31 +557,6 @@ unrelated fixes. In particular, updating the maintainer toolchain need not wait for the consumer-minimum decision. Implementation details and optional cleanup do not become release gates merely by appearing in this catalog. -### Decision 3: Authentication Response Budget And Overflow Outcome - -**Related findings:** [2](#2-bound-authentication-probe-response-consumption) -and [26](#26-move-openrouter-authentication-protocol-details-into-its-adapter). - -**Question:** What finite response budget should the authentication adapter -apply, and how should a probe report exceeding it? - -**Recommendation:** Select a conservative fixed budget for this small protocol, -check actual streamed bytes regardless of declared length, and close on overflow -without unbounded draining. Report the diagnostic failure with acceptance -unknown, retaining any independently observed HTTP facts. Agree the exact byte -count and its representation in the existing diagnostic report before coding; -the catalog does not select either implicitly. - -**Alternative:** Expose a caller-configurable budget with a finite default. -This accommodates unusual legitimate responses but expands configuration and -validation surface. It is worthwhile if a concrete consumer requirement cannot -be served by an appropriately chosen fixed budget; it is not necessary merely -to address the demonstrated unbounded read. - -**Resolve before implementation:** Choose the size, overflow classification, -and whether configurability is warranted. Keep this fix independent of adapter -relocation so architectural cleanup does not delay the resource remedy. - ### Decision 4: Exact Numbers And The Source-Conversion Boundary **Related findings:** [3](#3-avoid-exponential-expansion-during-convenience-source-conversion),