Files
cleveragents-core/features/steps
HAL9000 07469f55a5 fix(lsp): add depth/file/timeout limits to detect_directory_languages() to prevent DoS
Added robust guards to detect_directory_languages() by introducing depth, file count, and timeout controls. Defaults and validations are implemented to prevent resource exhaustion during LSP discovery.

- Added max_depth parameter (default: 50) with validation to ensure a positive integer.
- Added max_files parameter (default: 10,000) with validation to ensure a positive integer.
- Added timeout parameter (default: 30.0 seconds) with validation to ensure a positive float.
- Pass followlinks=False to os.walk() to prevent symlink-based DoS via recursive loops.
- Implemented depth tracking in the traversal loop with early break when max_depth is exceeded.
- Implemented file count tracking with early break when max_files is exceeded.
- Implemented periodic timeout checks during traversal to enforce the overall time limit.
- Added warning logging when traversal is terminated early due to any limit.
- Updated the function docstring to document the new parameters and their defaults.
- Created comprehensive BDD tests in features/lsp_discovery_dos_protection.feature to validate the protections.

ISSUES CLOSED: #7161
2026-06-14 20:39:38 -04:00
..