[paul-hammant]

std.cbor gets ready to decode bytes from an untrusted peer, such as the planned sandboxed-child IPC, where the parent decodes whatever the child sends.

• CborDecodeOptions / default_decode_options() / parse_with(data, opts), following std/tar's ExtractOptions. Defaults: depth 256 (unchanged), 131072 array elements and 131072 map pairs (fxamacker/cbor's defaults), duplicate keys refused, indefinite lengths allowed.
• parse refuses duplicate map keys (breaking, on purpose): {"grant":"none","grant":"all"} is an error, not a guess about which value wins. Keys are duplicates when they are the same value however encoded, so a definite and an indefinite "a" collide. parse_with with allow_duplicate_keys = 1 gives the old behaviour.
• A declared string length, array count or map count that can't fit in the bytes left is refused before anything is allocated, including counts near 2^64.
• encode_deterministic: RFC 8949 §4.2.1 core deterministic encoding (shortest heads and floats, definite lengths, map keys in bytewise order of their encodings, duplicate keys an error). encode still writes a parsed value back byte for byte (cbor/msgpack: trailing bytes accepted, cbor not-well-formed input accepted, cbor diagnose lossy #2470).

Drafted by Jules (paul-hammant#44): options, limits, deterministic encoder, and test_cbor_hardening.ae with vectors cited from fxamacker/cbor. Its PR lists a disable-the-protection check for each limit.

Shaped here (second commit):

• The duplicate-key check and the key sort were quadratic. A map at the 131072-pair limit, about 400 KB, cost billions of comparisons, turning the limit meant to make hostile input cheap to refuse into a way to burn CPU. Duplicates are now found by merge-sorting the keys' deterministic encodings and comparing neighbours (a std.map set would collide with cbor's own map_get), and encode_deterministic merge-sorts keys too. The new test_large_maps parses and sorts 131072 keys; the whole hardening test takes 0.84 s, and against the first commit's code it was still running when killed at 90 s.
• Restored comments the first commit removed (why lengths are compared in long, why counts are checked against the bytes left, parse's cbor/msgpack: trailing bytes accepted, cbor not-well-formed input accepted, cbor diagnose lossy #2470 note).
• Changelog fragment rewritten; docs/api regenerated.

Checked: test_cbor (all RFC 8949 Appendix A vectors), test_cbor_hardening and tests/regression/test_cbor_roundtrip_no_leak.ae pass; both std tests are valgrind-clean (0 errors); ae fmt, make check-docs, check-changelog and check-tests pass.

🤖 Generated with Claude Code