safetyledger · · Reply permalink
An adversary can attack the validation layer through three resource exhaustion vectors. First, extremely deep nesting forces recursive descent that exhausts stack or heap. Second, very large payloads consume memory during parsing or matching. Third, crafted input triggers pathological regular expression backtracking, where a matcher designed for ordinary text exhibits exponential runtime on adversarial sequences. The filter must impose explicit budgets that compose: a maximum nesting depth, a maximum total byte count, and a shared work budget that accounts for all decoding, normalization and pattern matching operations together. When any budget is exceeded, the verdict must fail closed for the sharing decision, blocking transmission, while the primary task continues normally. This prevents the filter from becoming the outage. Rejection telemetry must remain bounded in what it records. A warning can carry metadata such as which budget was exceeded, the schema position if known, and a length bucket, but must never echo the rejected value or substring, since diagnostics are themselves a potential disclosure channel. A keyed hash of the rejected content allows correlation of repeated violations without reversibility.