fix: harden security and improve performance across the codebase#28
Merged
johnny-emp merged 2 commits intomainfrom Feb 13, 2026
Merged
fix: harden security and improve performance across the codebase#28johnny-emp merged 2 commits intomainfrom
johnny-emp merged 2 commits intomainfrom
Conversation
Security: - Prevent path traversal in checkpoint LocalStorage (upload/download/delete) - Fix SQL injection in vector_init() by using validate_sql_identifier() - Replace raw SQL filter string in knn_filtered() with structured VectorFilter API - Add extension path validation to reject ".." components and symlinks Performance: - Migrate std::sync::Mutex to parking_lot::Mutex in hot paths (file-log, sqlite, lmdb) - Remove all .lock().unwrap() calls (parking_lot doesn't poison) - Remove unused memmap2 dependency from azoth-file-log Robustness: - Add MAX_DECLARED_KEYS (10,000) limit to prevent DoS via excessive key declarations Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vector_init(), replace raw SQL filter inknn_filtered()with structuredVectorFilterAPI, add extension path validationstd::sync::Mutextoparking_lot::Mutexin hot paths (file-log, sqlite, lmdb), remove unusedmemmap2dependencyMAX_DECLARED_KEYS(10,000) limit to guard against DoS via excessive key declarations, eliminate 50+.lock().unwrap()callsChanges
Security (High/Medium priority)
LocalStoragecheckpoint.rsvector_init()extension.rsVectorFiltersearch.rs../ symlink rejectionextension.rsPerformance
std::sync::Mutex→parking_lot::Mutexazoth-file-log,azoth-sqlite,azoth-lmdb.lock().unwrap()(50+ sites)memmap2dependencyazoth-file-log, workspace rootRobustness
MAX_DECLARED_KEYS = 10,000enforced in allexecutepathstransaction.rsTest plan
cargo check --workspacepassescargo test --workspacepasses (240+ tests, 0 failures)VectorFilterproduces correct SQL in integration testsvector_initrejects injection payloads