Skip to content

Harden WaterWorld input dimensions - #81

Closed
krotname wants to merge 1 commit into
mainfrom
codex/fix-unchecked-dimension-vulnerability-in-waterworld
Closed

Harden WaterWorld input dimensions#81
krotname wants to merge 1 commit into
mainfrom
codex/fix-unchecked-dimension-vulnerability-in-waterworld

Conversation

@krotname

Copy link
Copy Markdown
Owner

Motivation

  • Prevent process crashes and DoS caused by unchecked 32-bit multiplication and unvalidated CLI dimensions that could trigger NegativeArraySizeException, ArrayIndexOutOfBoundsException, or OutOfMemoryError when allocating the map or BFS queue.
  • Avoid silent integer-parser overflow and malformed numeric tokens that can produce attacker-controlled dangerous dimensions.

Description

  • Add a centralized validator checkedTotalCells(n, m) with a MAX_CELLS limit and use long multiplication to detect overflow and overly large maps, and throw IllegalArgumentException for invalid sizes.
  • Use the validated total in solve and run, and check map.length consistency before allocating the BFS queue.
  • Harden FastIn.nextInt() to reject non-digit characters and detect integer overflow while parsing, throwing IOException for invalid tokens.
  • Wrap the CLI run() invocation in main with a try/catch that ignores IllegalArgumentException and IOException so invalid input is rejected gracefully without performing large allocations.

Testing

  • Compiled the modified file with javac -d /tmp/classes src/main/java/algorithms/sprint6/WaterWorld.java and compilation succeeded.
  • Verified correct behavior on valid input using printf '3 3\n#.#\n.#.\n#.#\n' | java -cp /tmp/classes algorithms.sprint6.WaterWorld which produced the expected output.
  • Verified malicious inputs are rejected without crashing by running printf '50000 50000\n' | java -cp /tmp/classes algorithms.sprint6.WaterWorld and printf '2147483648 1\n' | java -cp /tmp/classes algorithms.sprint6.WaterWorld, both of which no longer trigger allocation crashes.
  • Ran project tests with mvn test (initial run failed due to a transient Maven Central 502 Bad Gateway while resolving a dependency) and then retried mvn -q test, which completed (transient network failure noted).

Codex Task

@codecov

codecov Bot commented Jul 31, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 35.71429% with 9 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
src/main/java/algorithms/sprint6/WaterWorld.java 35.71% 6 Missing and 3 partials ⚠️

📢 Thoughts on this report? Let us know!

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
57.1% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@krotname

krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner Author

Закрываю как superseded by #116: изменения перенесены в одну проверенную ветку, все review findings учтены; локальный mvn verify прошёл полностью.

@krotname krotname closed this Aug 1, 2026
@krotname
krotname deleted the codex/fix-unchecked-dimension-vulnerability-in-waterworld branch August 1, 2026 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant