Skip to content

Clamp session diagnostics browse names#1747

Merged
kevinherron merged 1 commit into
eclipse-milo:mainfrom
kevinherron:codex/propose-fix-for-session-name-vulnerability
May 17, 2026
Merged

Clamp session diagnostics browse names#1747
kevinherron merged 1 commit into
eclipse-milo:mainfrom
kevinherron:codex/propose-fix-for-session-name-vulnerability

Conversation

@kevinherron
Copy link
Copy Markdown
Contributor

Motivation

  • Creating diagnostics nodes used the raw client-controlled session name as a QualifiedName BrowseName which throws an unchecked IllegalArgumentException for names over 512 characters and could leak sessions/nodes leading to DoS.

Description

  • Add MAX_BROWSE_NAME_LENGTH = 512 and a helper sessionNameBrowseName(String) to truncate session names to the QualifiedName limit before constructing the BrowseName.
  • Use the truncated value for sdoNode.setBrowseName(...) while preserving the original session name for setDisplayName(...) so presentation is unchanged.
  • Add focused unit tests SessionsDiagnosticsSummaryObjectTest that verify valid names are preserved and overlong names are truncated and accepted by QualifiedName.

Codex Task

@kevinherron kevinherron added this to the 1.1.4 milestone May 17, 2026
@kevinherron kevinherron merged commit f44b928 into eclipse-milo:main May 17, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant