🛡️ Sentinel: Add input length limits to config caching#495
Conversation
Adds a length validation check to the `CACHE_START_CONFIG` payload in `background.js` to mitigate Denial of Service (DoS) attacks that could exceed `chrome.storage.session` quotas. Also includes corresponding security tests in `tests/security.test.js`. Co-authored-by: n24q02m <135627235+n24q02m@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Adds a length validation check to the `CACHE_START_CONFIG` payload in `background.js` to mitigate Denial of Service (DoS) attacks that could exceed `chrome.storage.session` quotas. Also includes corresponding security tests in `tests/security.test.js`. Also fixes CI failures: - Migrates `.biome.json` using `biome migrate --write`. - Fixes `popup.html` a11y issues by using semantic `<fieldset>` and `<legend>` for groups. - Updates `popup.test.js` to align with HTML changes. Co-authored-by: n24q02m <135627235+n24q02m@users.noreply.github.com>
1 participant
🚨 Severity: MEDIUM
💡 Vulnerability: The application was caching the
CACHE_START_CONFIGpayload received from untrusted web pages via content scripts without validating its size.🎯 Impact: A malicious or compromised webpage could send an enormous configuration object, causing the extension to exhaust its
chrome.storage.sessionquota (typically 1MB), leading to a Denial of Service (DoS) condition that breaks extension functionality.🔧 Fix: Added a payload length check in
background.jsto ensure the serialized config is less than 50,000 characters before attempting to persist it.✅ Verification: Verified via a new unit test in
tests/security.test.jsthat checks if oversized payloads are cleanly rejected with a Security Error. All Biome linting and testing checks pass.PR created automatically by Jules for task 7488938609954217740 started by @n24q02m