Skip to content

Harden rail fence cipher decoding against resource exhaustion - #109

Closed
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-railfencecipher-vulnerability
Closed

Harden rail fence cipher decoding against resource exhaustion#109
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-railfencecipher-vulnerability

Conversation

@krotname

@krotname krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The previous decode implementation performed allocations and O(n^2) work based on the caller-controlled rail count n, and created per-character String/LinkedList objects even for empty input, enabling CPU/memory exhaustion for large n.
  • The change aims to prevent resource amplification while preserving the kata's decode semantics for valid inputs (rails >= 2) and typical test cases.

Description

  • Validate the rail count by throwing IllegalArgumentException if n < 2, and return immediately when s.isEmpty() or n >= s.length() to avoid unnecessary work and allocations.
  • Replace the quadratic sumArr scans and TreeMap/LinkedList per-character conversions with an int[] position offset array and a single StringBuilder result to reconstruct characters directly from the input.
  • Remove per-character String allocations and linked-list buffering so decoding runs in linear time relative to the input length plus rail bookkeeping.
  • Add a regression test shouldDecodeWithoutAllocatingForUnusedRails asserting that extreme rail counts (e.g. Integer.MAX_VALUE) do not cause allocation or incorrect decoding for empty and short inputs.

Testing

  • Ran mvn -Dtest=RailFenceCipherTest test and the RailFenceCipherTest suite completed with all tests passing (5 tests, 0 failures).
  • Ran the full test suite with mvn -q test and it completed successfully with no test failures.

Codex Task

@krotname

krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner Author

Superseded by the validated combined merge in #115: #115

@krotname krotname closed this Aug 1, 2026
@krotname
krotname deleted the codex/propose-fix-for-railfencecipher-vulnerability branch August 1, 2026 02:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant