Skip to content

Harden the Jelly parsers against hostile inputs - #736

Merged
Ostrzyciel merged 3 commits into
mainfrom
piotr/hardening
Sep 19, 2026
Merged

Ostrzyciel merged 3 commits into
mainfrom
piotr/hardening

Conversation

@Ostrzyciel

Copy link
Copy Markdown
Member
  • Add null checks and catch some other exceptions to throw prettier errors. These checks are free because the JVM inserts them anyway.
  • Limited number of rows per frame in Jelly-SPARQL to mitigate an OOM DoS vector.
  • Add tests for specific known hostile inputs.
  • Add fuzzing tests for the decoder.

Only the sparql decoder was susceptible to an OOM DoS (good, it was not even released yet). The rest were just throwing ugly exceptions.

…rrors. These checks are free because the JVM inserts them anyway.

- Limited number of rows per frame in Jelly-SPARQL to mitigate an OOM DoS vector.
- Add tests for specific known hostile inputs.
…rrors. These checks are free because the JVM inserts them anyway.

- Limited number of rows per frame in Jelly-SPARQL to mitigate an OOM DoS vector.
- Add tests for specific known hostile inputs.
- Add fuzzing tests for the decoder.
@codecov

codecov Bot commented Sep 18, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 93.75000% with 3 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
.../neverblink/jelly/core/internal/DecoderLookup.java 78.57% 3 Missing ⚠️
Files with missing lines Coverage Δ Complexity Δ
...nk/jelly/core/patch/internal/PatchDecoderImpl.java 97.45% <100.00%> (+3.98%) 46.00 <15.00> (+5.00)
...jelly/core/sparql/JellySparqlConverterFactory.java 100.00% <100.00%> (ø) 4.00 <2.00> (+1.00)
.../jelly/core/sparql/internal/SparqlDecoderImpl.java 100.00% <100.00%> (ø) 74.00 <0.00> (+1.00)
.../jelly/core/sparql/internal/SparqlEncoderImpl.java 99.46% <100.00%> (ø) 111.00 <5.00> (ø)
...everblink/jelly/core/internal/NameDecoderImpl.java 83.95% <100.00%> (+1.51%) 13.00 <0.00> (+1.00)
...verblink/jelly/core/internal/ProtoDecoderImpl.java 97.26% <100.00%> (+4.95%) 28.00 <0.00> (+4.00)
...k/jelly/convert/jena/sparql/RowSetReaderJelly.java 81.15% <100.00%> (+1.15%) 11.00 <0.00> (ø)
...onvert/rdf4j/sparql/AbstractJellySparqlParser.java 86.20% <100.00%> (+0.75%) 9.00 <0.00> (ø)
...onvert/rdf4j/sparql/JellySparqlParserSettings.java 100.00% <100.00%> (ø) 2.00 <0.00> (ø)
.../neverblink/jelly/core/internal/DecoderLookup.java 86.36% <78.57%> (+6.36%) 5.00 <2.00> (+2.00)

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Ostrzyciel
Ostrzyciel merged commit eeaf94e into main Sep 19, 2026
10 of 11 checks passed
@Ostrzyciel
Ostrzyciel deleted the piotr/hardening branch September 19, 2026 08:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants