[dmt] Harden chart loading against symlink loops and oversized files

README.md

@@ -237,6 +237,14 @@ linters-settings:
 
   documentation:
     impact: error
+    exclude-rules:
+      # Silence the "file too large" warning for generated/bundled docs
+      # (size check only; content checks are unaffected)
+      file-size:
+        files:
+          - docs/generated-reference.md
+        directories:
+          - docs/generated/
 
   templates:
     impact: error

go.mod

@@ -33,7 +33,7 @@ require (
 	github.com/spf13/viper v1.19.0
 	github.com/stretchr/testify v1.10.0
 	github.com/tidwall/gjson v1.18.0
-	github.com/werf/nelm v1.24.3
+	github.com/werf/nelm v1.26.1
 	golang.org/x/mod v0.27.0
 	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/yaml.v3 v3.0.1

go.sum

@@ -415,8 +415,8 @@ github.com/werf/lockgate v0.1.1 h1:S400JFYjtWfE4i4LY9FA8zx0fMdfui9DPrBiTciCrx4=
 github.com/werf/lockgate v0.1.1/go.mod h1:0yIFSLq9ausy6ejNxF5uUBf/Ib6daMAfXuCaTMZJzIE=
 github.com/werf/logboek v0.6.1 h1:oEe6FkmlKg0z0n80oZjLplj6sXcBeLleCkjfOOZEL2g=
 github.com/werf/logboek v0.6.1/go.mod h1:Gez5J4bxekyr6MxTmIJyId1F61rpO+0/V4vjCIEIZmk=
-github.com/werf/nelm v1.24.3 h1:KX5uk0rHymdOW6T3Nxrl2nuR1mI4c7FAsSQkI03ckIk=
-github.com/werf/nelm v1.24.3/go.mod h1:Gy6XJ42rwJVA+UyB6ka9/DVFPzm+lh7lmcjLAZECdIs=
+github.com/werf/nelm v1.26.1 h1:0gH8JuJlKZtPLpeRAt4H9mVLRzDQwNqhcllxcr2UTDg=
+github.com/werf/nelm v1.26.1/go.mod h1:D3uU5e1dSBc0l0oo/iB6SjM2sLaXICqRDSWXAYF+vpk=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=

internal/fsutils/fsutils.go

@@ -17,6 +17,7 @@ limitations under the License.
 package fsutils
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -31,6 +32,40 @@ import (
 // evalSymlinkCache is a cache for evaluated symlinks to avoid multiple evaluations
 var evalSymlinkCache sync.Map
 
+// MaxLintableFileSize bounds how large a file dmt will read into memory while
+// linting. Files above it are generated data blobs (bundled Grafana dashboards,
+// rendered openapi, CRD bundles), not hand-written sources; reading a
+// multi-gigabyte file just to scan it would exhaust memory and flood the log.
+const MaxLintableFileSize = 10 << 20 // 10 MiB
+
+// ErrFileTooLarge is returned by ReadFile when a file exceeds MaxLintableFileSize.
+var ErrFileTooLarge = errors.New("file too large to lint")
+
+// ReadFile reads the named file like os.ReadFile but refuses files larger than
+// MaxLintableFileSize, returning ErrFileTooLarge instead of loading a huge file
+// into memory. Callers that scan discovered files should treat ErrFileTooLarge
+// as "skip this file" rather than a hard failure.
+func ReadFile(path string) ([]byte, error) {
+	info, err := os.Stat(path)
+	if err != nil {
+		return nil, err
+	}
+
+	if info.Size() > MaxLintableFileSize {
+		return nil, fmt.Errorf("%w: %s (%d bytes)", ErrFileTooLarge, path, info.Size())
+	}
+
+	return os.ReadFile(path)
+}
+
+// IsFileTooLarge reports whether err was produced by ReadFile refusing an
+// oversized file. Linters that scan discovered files use it to skip such files
+// rather than failing. It exists so callers need not import the standard errors
+// package, which many of them alias to dmt's own errors package.
+func IsFileTooLarge(err error) bool {
+	return errors.Is(err, ErrFileTooLarge)
+}
+
 // IsDir checks if the given path is a directory
 func IsDir(path string) bool {
 	fi, err := os.Stat(path)

internal/fsutils/readfile_test.go

@@ -0,0 +1,73 @@
+/*
+Copyright 2025 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fsutils
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestReadFile_ReadsNormalFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "ok.txt")
+
+	want := []byte("hello")
+	if err := os.WriteFile(path, want, 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	got, err := ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile: %v", err)
+	}
+
+	if string(got) != string(want) {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}
+
+func TestReadFile_RejectsOversizedFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "huge.bin")
+
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+
+	if err := f.Truncate(MaxLintableFileSize + 1); err != nil {
+		t.Fatalf("truncate: %v", err)
+	}
+
+	if err := f.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	got, err := ReadFile(path)
+	if err == nil {
+		t.Fatalf("expected an error for an oversized file, got %d bytes", len(got))
+	}
+
+	if !IsFileTooLarge(err) {
+		t.Errorf("expected IsFileTooLarge to report true for %v", err)
+	}
+
+	if got != nil {
+		t.Errorf("expected no data for an oversized file, got %d bytes", len(got))
+	}
+}