From 3254c99e6c087b87326007b59de47e2c4e0e1e2f Mon Sep 17 00:00:00 2001 From: Juan Mantica Date: Mon, 10 Aug 2026 15:33:50 -0400 Subject: [PATCH 1/3] fix(security): bound allocation paths in the stcp, gcs and wef sources Bumps the private submodule. Contents: stcp - max_frame_bytes bounds the per-connection receive buffer, defaulting to 4x max_event_size. The cap covers a partially-read frame plus anything the peer pipelined behind it, so at parity with max_event_size a single legitimate max-size event arriving with one trailing byte would close the connection. - max_lines_per_event (1e6) bounds the O(N*M) clone amplification from a large RAW field with many newlines combined with a large field map. - read_leb128_i64 returned Ok(0) on buffer exhaustion, a silent truncation that let a zero count bypass downstream loop guards; it now returns InSufficientData so the framer waits for more bytes. - `warn!` was used without being imported, so the crate did not compile. gcs - max_decompressed_bytes (4 GiB) caps decompressor output. Objects are streamed line-by-line and never buffered whole, so this is a runaway-decompressor guard rather than the memory bound; it sits above documented producer maxima (BigQuery exports 1 GB uncompressed per file, Cloud Logging 3.5 GiB) so real objects are not truncated. Truncation is logged and counted. wef - max_content_length is enforced on the HTTP body via Limited. It and max_envelope_size are independent settings, so the enforced value is max(configured, 4x largest advertised envelope) -- otherwise raising the advertised size alone would 413 every batch. The body is strictly larger than the envelope it carries: the Kerberos path adds multipart framing and a GSS wrap header. - sldc::decompress returns a typed SizeLimitExceeded. Both call sites treated any error as "input was not compressed" and fell back to the raw bytes, so an oversized stream was silently reinterpreted as plaintext UTF-16. Co-Authored-By: Claude Opus 5 --- changelog.d/stcp_gcs_wef_bounds.enhancement.md | 8 ++++++++ lib/observo/private | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 changelog.d/stcp_gcs_wef_bounds.enhancement.md diff --git a/changelog.d/stcp_gcs_wef_bounds.enhancement.md b/changelog.d/stcp_gcs_wef_bounds.enhancement.md new file mode 100644 index 000000000..5ea948165 --- /dev/null +++ b/changelog.d/stcp_gcs_wef_bounds.enhancement.md @@ -0,0 +1,8 @@ +Bounded previously-unbounded allocation paths in three sources: + +- `stcp`: new `max_frame_bytes` (4x `max_event_size`, 64 MiB) bounds the per-connection receive + buffer, and `max_lines_per_event` (1e6) bounds the events produced from one RAW field. +- `gcp_gcs`: new `max_decompressed_bytes` (4 GiB) caps decompressed object size; truncation is + logged and counted by `gcs_object_truncated_total`. +- `wef`: `max_content_length` is now enforced on the inbound HTTP body, defaulting to 4x the + advertised `max_envelope_size` and never dropping below it. diff --git a/lib/observo/private b/lib/observo/private index b90e4cf6d..c377dffb5 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit b90e4cf6d3e783b68b1e1929492975f9cfaea24a +Subproject commit c377dffb5586308c3387e5337474b2ca01091591 From 5bcac9282b89fbcbd3280ce995c5e1c03b4c67fc Mon Sep 17 00:00:00 2001 From: Juan Mantica Date: Tue, 11 Aug 2026 17:39:22 -0400 Subject: [PATCH 2/3] trivial: remove changelog md --- changelog.d/stcp_gcs_wef_bounds.enhancement.md | 8 -------- 1 file changed, 8 deletions(-) delete mode 100644 changelog.d/stcp_gcs_wef_bounds.enhancement.md diff --git a/changelog.d/stcp_gcs_wef_bounds.enhancement.md b/changelog.d/stcp_gcs_wef_bounds.enhancement.md deleted file mode 100644 index 5ea948165..000000000 --- a/changelog.d/stcp_gcs_wef_bounds.enhancement.md +++ /dev/null @@ -1,8 +0,0 @@ -Bounded previously-unbounded allocation paths in three sources: - -- `stcp`: new `max_frame_bytes` (4x `max_event_size`, 64 MiB) bounds the per-connection receive - buffer, and `max_lines_per_event` (1e6) bounds the events produced from one RAW field. -- `gcp_gcs`: new `max_decompressed_bytes` (4 GiB) caps decompressed object size; truncation is - logged and counted by `gcs_object_truncated_total`. -- `wef`: `max_content_length` is now enforced on the inbound HTTP body, defaulting to 4x the - advertised `max_envelope_size` and never dropping below it. From be7af65c1709c9734f2ac58668d3e523adb87eb1 Mon Sep 17 00:00:00 2001 From: Juan Mantica Date: Tue, 11 Aug 2026 17:46:09 -0400 Subject: [PATCH 3/3] fix(security): [OBE-10709,OBE-10718,OBE-11236] bump dataplane-private to gcs/wef-only bounds branch Co-Authored-By: Claude Sonnet 4.6 --- lib/observo/private | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/observo/private b/lib/observo/private index c377dffb5..576b18414 160000 --- a/lib/observo/private +++ b/lib/observo/private @@ -1 +1 @@ -Subproject commit c377dffb5586308c3387e5337474b2ca01091591 +Subproject commit 576b18414443e2c95c413a83616c63a3ca712119