mirror of
https://github.com/ruvnet/RuView
synced 2026-07-21 17:13:19 +00:00
rUv
5bc3b634b7
* fix(homecore-automation): bound template render to stop unbounded-expansion DoS (HC-SEC-01)
A `template:` condition / value_template comes straight from user
automation config and was rendered with MiniJinja's default (no
instruction budget, no output cap). A single condition such as
`{% for i in range(5000) %}{% for j in range(5000) %}xxxx{% endfor %}{% endfor %}`
rendered a 100 MB string over ~11 s on one render call (proven
empirically) — a CPU/memory denial of service, the bfld-class
"unbounded expansion".
Fix:
- Enable MiniJinja's `fuel` feature and set a per-render instruction
budget (`set_fuel(Some(1_000_000))`). A nested loop burns one unit
per iteration, so the budget caps total work regardless of nesting;
the attack now fails fast (~90 ms) with "engine ran out of fuel".
- Reject template sources over 64 KiB before compilation (defense in
depth so a pathological literal can neither compile nor emit verbatim).
Legitimate HA templates (a few dozen instructions) are unaffected.
Tests (fail on old — unbounded render / no rejection):
- nested_loop_template_is_bounded_not_unbounded_dos
- single_huge_repeat_template_is_bounded
- oversized_template_source_is_rejected
- legitimate_template_still_renders_within_fuel (no regression)
Co-Authored-By: claude-flow <ruv@ruv.net>
* fix(homecore-automation): stop crafted delay/timeout from panicking the run task (HC-SEC-02)
`Action::Delay { seconds }` and `Action::WaitForTrigger { timeout_seconds }`
fed the user-supplied float straight into `Duration::from_secs_f64`, which
PANICS on negative, NaN, infinite, or overflowing inputs. All of those are
reachable from a crafted (or simply typo'd) automation YAML —
`delay: {seconds: -1}`, `.nan`, `.inf`, `1e308` — so one hostile config
aborts the spawned automation task with a panic
("cannot convert float seconds to Duration: value is negative", proven
empirically).
Fix: a `safe_duration_from_secs` guard that saturates instead of panicking,
matching Home Assistant's lenient "non-positive delay = no delay":
- NaN / ±inf / negative -> Duration::ZERO
- absurdly large (would overflow) -> clamped to ~100 years (MAX_DELAY_SECS)
Tests (fail on old — panic = failure):
- delay_negative_seconds_does_not_panic
- delay_nan_seconds_does_not_panic
- delay_infinite_seconds_does_not_panic
- wait_for_trigger_negative_timeout_does_not_panic
- safe_duration_saturates_hostile_values (incl. overflow clamp)
Co-Authored-By: claude-flow <ruv@ruv.net>
* docs(homecore-automation): record HC-SEC-01/02 security review (CHANGELOG + ADR-129 §8a)
Document the two DoS findings (template unbounded-expansion HC-SEC-01,
delay panic-on-config HC-SEC-02) and the dimensions probed clean
(condition fail-closed, bounded run-modes, sandboxed read-only templates).
Co-Authored-By: claude-flow <ruv@ruv.net>
51 lines
1.8 KiB
TOML
51 lines
1.8 KiB
TOML
# homecore-automation — HOMECORE automation engine, trigger evaluator, and
|
|
# MiniJinja template evaluator.
|
|
# Implements ADR-129 (HOMECORE-AUTO): YAML automation parser, trigger/condition/
|
|
# action evaluation, AutomationEngine runtime that subscribes to the HOMECORE
|
|
# event bus and fires automations.
|
|
|
|
[package]
|
|
name = "homecore-automation"
|
|
version = "0.1.0-alpha.0"
|
|
edition = "2021"
|
|
license = "MIT"
|
|
authors = ["rUv <ruv@ruv.net>", "HOMECORE Contributors"]
|
|
description = "Automation engine, trigger evaluator, and MiniJinja template evaluator for HOMECORE (ADR-129)"
|
|
repository = "https://github.com/ruvnet/RuView"
|
|
|
|
[lib]
|
|
name = "homecore_automation"
|
|
path = "src/lib.rs"
|
|
|
|
[dependencies]
|
|
# HOMECORE core — state machine, event bus, service registry, entity types
|
|
homecore = { path = "../homecore" }
|
|
|
|
# Async runtime
|
|
tokio = { version = "1", features = ["sync", "rt", "rt-multi-thread", "time", "macros"] }
|
|
|
|
# Serialization — YAML automation files + JSON service call data
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_yaml = "0.9"
|
|
serde_json = "1"
|
|
|
|
# MiniJinja — HA-compatible Jinja2 template engine in pure Rust (ADR-129 §2.1).
|
|
# `fuel` bounds instruction count so a malicious `template:` condition cannot
|
|
# spin the engine with a nested-loop / huge-repeat DoS (HC-SEC-01).
|
|
minijinja = { version = "2", features = ["json", "loader", "fuel"] }
|
|
|
|
# Error handling
|
|
thiserror = "1"
|
|
|
|
# Time — chrono DateTime for triggers + condition evaluation
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
|
|
# Async trait for EvaluateTrigger + condition evaluate
|
|
async-trait = "0.1"
|
|
|
|
# Unique IDs for automation instances
|
|
uuid = { version = "1", features = ["v4"] }
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1", features = ["sync", "rt", "rt-multi-thread", "time", "macros", "test-util"] }
|