Agent-emitted diff canvases had no line/hunk/file caps in the Zod schema. With the existing 256 KB byte budget per canvas an attacker or buggy agent could pack tens of thousands of one-character add/del lines, causing CanvasDiff to render hundreds of thousands of DOM rows on every 5s poll and freeze the session detail page. Adds three caps in canvas-schema.ts mirroring the synthesized git-diff path's existing constants: DIFF_MAX_LINES_PER_HUNK = 1000 DIFF_MAX_HUNKS_PER_FILE = 50 DIFF_MAX_FILES_PER_CANVAS = 200 Two new tests prove over-cap diffs are rejected. Refs: docs/canvases-codex-review-2026-05-06.html (the P2) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ao | ||
| cli | ||
| core | ||
| integration-tests | ||
| plugins | ||
| web | ||