Repository navigation
fix(people): bind confirmed-hire ASGI body-frame authority before parsing #325
Description
Canonical owner: PR #55 confirmed-hire transport boundary.
Fresh audit after #324 found the remaining confirmed-hire request-body boundary still performs executable operations on unproven ASGI frame objects:
_read_json_object(...)invokesmessage.get(...)without proving an exact built-indictframe;- it compares
message["type"]without proving exact built-instr; - it accepts
bytes/bytearraysubclasses forbodyand then callslen(...)/ extends the aggregate buffer.
The request body is already byte/frame/depth bounded, but those limits only matter after the transport frame and scalar representation are trusted. A custom/hostile ASGI adapter can therefore execute subtype behavior before the boundary's own validation.
Required repair: test-first hostile frame/type/body regressions; require exact built-in frame/scalar authority before get, comparison, length, or buffer extension; preserve normal ASGI dict + bytes frames, 400/413 semantics, bounded frame count/size/nesting, and zero mutation-port execution on rejection. Keep open until exact-head protected acceptance/integration.
Activity
seonghobae commentedon Sep 14, 2026
#325 is repaired on canonical owner PR #55.
9a362b4d77b71b16b906b665b14f2633135bd97bbd1390a79e04ea9f44179ab71d98acd20b5793bbThe transport now proves an exact built-in ASGI body-frame
dictbefore.get, an exact built-in message-typestrbefore comparison, and exact built-in bodybytesbefore length accounting or buffer extension. Regression coverage includes hostile dict/string/bytes subclasses, explicitbytearrayrejection, and an exact built-in happy path. Existing frame-count/body-size/nesting limits are preserved.Exact-head Security
34832584337, SAST34832584132, Foundation34832584097, and CodeQL34832584082are queued. No hosted RED/GREEN or independent approval is claimed. Employment descendants were ordinary-forward restacked without force to #14914901b478c38718838d406004146d1a4df28454e→ #155a41c5d943b44a7d5724c18491652529c841980c8→ #1560d133eacc04e8bd413aeccf32046cf9140b0c517.Keep #325 open until exact-head protected acceptance and normal integration.