Skip to content

Potential fix for code scanning alert no. 5: Size computation for allocation may overflow #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Lawrence Lucas Large (LukeLarge) merged 1 commit into from
Dec 3, 2025
Merged

Potential fix for code scanning alert no. 5: Size computation for allocation may overflow #9

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion internal/g/camel_snake.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,10 @@ func CamelToSnake(s string) string {
}

func ChangeJsonKeys(input []byte, f func(s string) string) []byte {

// Guard against allocation overflow: reject very large input
if len(input) > 64*1024*1024 { // 64MB
return input // Or nil, or error handling as you prefer

Copilot AI Dec 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The inline comment "// Or nil, or error handling as you prefer" should be removed. This comment appears to be placeholder text from development and doesn't add value to production code. Comments should explain "why" not list alternative implementations.

Suggested change
return input // Or nil, or error handling as you prefer
return input

Copilot uses AI. Check for mistakes.
}
Comment on lines +29 to +32

Copilot AI Dec 3, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Returning the untransformed input when the size limit is exceeded could lead to incorrect behavior. The function is expected to transform JSON keys (e.g., camel case to snake case), but returning the original input would skip this transformation silently.

This could cause:

  • API responses with inconsistent key naming (some camelCase, some snake_case)
  • Consumers expecting transformed keys to receive untransformed data
  • Silent data corruption where callers won't know the transformation failed

Consider one of these alternatives:

  1. Return an error (though this would require changing the function signature)
  2. Use a panic with a descriptive message for such exceptional cases
  3. Log a warning and continue with the existing error handling pattern (line 44 also returns input on error)

Given that line 44 already returns the untransformed input on JSON parsing errors, option 3 (adding logging) might be most consistent with the existing error handling approach.

Copilot uses AI. Check for mistakes.
buf := bytes.NewBuffer(make([]byte, 0, len(input)+8))
isMap := false
nextTokenIsKey := false
Expand Down
Loading