harden: grpc input validation, ttl overflow, cursor truncation - #126
Merged
Conversation
- add validate_key() and validate_value() helpers with size limits (512KB keys, 512MB values) applied to GET, SET, DEL, MGET, MSET - add vector-specific limits: dimensions (65K), vsim count (10K), hnsw connectivity and ef_construction (1K each) applied to VADD, VSIM - fix TTL overflow: s * 1000 -> s.saturating_mul(1000) in PTTL handler - fix scan cursor truncation on 32-bit: keep modulo arithmetic in u64 space before converting shard index to usize
kacy
force-pushed
the
security/ember-server
branch
from
February 14, 2026 21:51
1741b71 to
8353590
Compare
kacy
added a commit
that referenced
this pull request
Feb 19, 2026
- add validate_key() and validate_value() helpers with size limits (512KB keys, 512MB values) applied to GET, SET, DEL, MGET, MSET - add vector-specific limits: dimensions (65K), vsim count (10K), hnsw connectivity and ef_construction (1K each) applied to VADD, VSIM - fix TTL overflow: s * 1000 -> s.saturating_mul(1000) in PTTL handler - fix scan cursor truncation on 32-bit: keep modulo arithmetic in u64 space before converting shard index to usize
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
summary
adds input validation to grpc handlers and fixes two numeric edge cases.
input validation
validate_key()rejects empty keys and keys over 512KBvalidate_value()rejects values over 512MB≤ 10,000, hnsw M ≤ 1,024, ef_construction ≤ 1,024
ttl overflow (S5)
s * 1000, which wrapson large TTLs. changed to
s.saturating_mul(1000).cursor truncation (S6)
req.cursor as usizewhich truncateson 32-bit platforms. moved the modulo arithmetic into u64 space so the
conversion to usize only happens on the (small) shard index result.
what was tested
all 43 ember-server tests pass. also checked clean compile with the
vector feature enabled (
--features protobuf,grpc,vector).design considerations
validation limits are deliberately generous — they protect against
obviously malformed requests (e.g. multi-gigabyte keys from a fuzzer)
without restricting any realistic workload. the constants live at module
scope next to the existing helper functions.