From 61a57ffc0ac01a3fdbf04453884fde18a013810e Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Fri, 31 Jul 2026 17:06:12 +0500 Subject: [PATCH] fix: enforce size limit on local workflow YAML files The codebase defines _MAX_WORKFLOW_YAML_BYTES (5 MiB) and enforces it on HTTP-downloaded workflows, but local YAML files read via _validate_and_install_local() had no size guard. A user or script pointing 'specify workflow install' at an arbitrarily large local file could cause unbounded memory allocation. Apply the same limit. --- src/specify_cli/workflows/_commands.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/specify_cli/workflows/_commands.py b/src/specify_cli/workflows/_commands.py index b465610d3b..f42e8874bb 100644 --- a/src/specify_cli/workflows/_commands.py +++ b/src/specify_cli/workflows/_commands.py @@ -1463,7 +1463,13 @@ def _validate_and_install_local( try: with yaml_path.open("rb") as source_file: source_mode = os.fstat(source_file.fileno()).st_mode & 0o7777 - source_content = source_file.read() + source_content = source_file.read(_MAX_WORKFLOW_YAML_BYTES + 1) + if len(source_content) > _MAX_WORKFLOW_YAML_BYTES: + console.print( + f"[red]Error:[/red] Workflow YAML file exceeds " + f"{_MAX_WORKFLOW_YAML_BYTES}-byte limit" + ) + raise typer.Exit(1) definition = WorkflowDefinition.from_string( source_content.decode("utf-8") )