Skip to content

fix: limit sortKey to at most 255 bytes - #1084

Merged
jmattheis merged 5 commits into
masterfrom
sort-key-big
Nov 9, 2026
Merged

jmattheis merged 5 commits into
masterfrom
sort-key-big

Conversation

@jmattheis

Copy link
Copy Markdown
Member

Much bigger sortKeys could crash gotify.

Much bigger sortKeys could crash gotify.
@jmattheis
jmattheis requested a review from a team as a code owner November 8, 2026 13:55
@eternal-flame-AD

Copy link
Copy Markdown
Member

I think it might be helpful to add a go fuzz case for ValidateSortKey and see if there are further problematic inputs?

KeyBetween("", "A" + 25 zeros + "1") returns smallestInt, which
ValidateOrderKey rejects because it cannot be decremented so nothing
could sort before it.

This appends midpoint("", "") = "V" (0.5) as fraction to the sort key.
@jmattheis

Copy link
Copy Markdown
Member Author

Good suggestion, added a fuzz test and some fixes for the implementation.

@codecov

codecov Bot commented Nov 8, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 96.42857% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 81.68%. Comparing base (5ce7f0a) to head (7272a93).

Files with missing lines Patch % Lines
fracdex/fracdex.go 95.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1084      +/-   ##
==========================================
+ Coverage   81.61%   81.68%   +0.07%     
==========================================
  Files          69       69              
  Lines        3241     3260      +19     
==========================================
+ Hits         2645     2663      +18     
- Misses        596      597       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@eternal-flame-AD eternal-flame-AD left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm!

@jmattheis
jmattheis added this pull request to the merge queue Nov 9, 2026
Merged via the queue into master with commit 01086b9 Nov 9, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants