Skip to content

Harden Distances input and output handling - #93

Closed
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-distances.run-vulnerability
Closed

Harden Distances input and output handling#93
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-distances.run-vulnerability

Conversation

@krotname

@krotname krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner

Motivation

  • Prevent local file-clobbering via fixed output.txt and unbounded array allocation from attacker-controlled input by removing fixed-path file I/O and validating sizes.
  • Preserve existing algorithm behavior and contest-style entrypoint while removing unsafe defaults that follow symlinks and allow NegativeArraySizeException/OutOfMemoryError.

Description

  • Replaced fixed new FileInputStream("input.txt") / new FileOutputStream("output.txt") usage by adding run(InputStream, OutputStream) and delegating the no-arg run() to run(System.in, System.out) so callers supply streams.
  • Added private static final int MAX_INPUT_SIZE = 100_000 and validate n with if (n < 1 || n > MAX_INPUT_SIZE) to reject negative, zero, or excessive sizes before allocating the int[].
  • Ensured buffered output is fully propagated by calling the underlying stream's flush() from FastOut.flush().
  • Added focused tests: src/test/java/algorithms/sprint1/DistancesTest.java for normal stream I/O and invalid sizes, and updated AlgorithmCliTest to exercise Distances.run via standard I/O instead of contest files.

Testing

  • Ran git diff --check with no reported whitespace problems.
  • Executed mvn -q -Dtest=algorithms.sprint1.DistancesTest test, which passed the new unit tests.
  • Executed mvn -q verify, and the full test suite completed successfully (integration and unit tests passed; Maven emitted only a non-failing JDK/deprecation warning).

Codex Task

@krotname

krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner Author

Superseded by the validated combined merge in #115: #115

@krotname krotname closed this Aug 1, 2026
@krotname
krotname deleted the codex/propose-fix-for-distances.run-vulnerability branch August 1, 2026 02:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant