Wire evaluate_with_timeout into the production sync filter path (ReDoS guard unused) #370

New Issue

2026-07-31T23:35:11Z

KofTwentyTwo commented

2026-07-31 23:35:11 +00:00

(Migrated from github.com)

OBS-4 (#360, PR #369) fixed and tested the filter ReDoS eval-timeout guard, but flagged that crates/nuncio-filter evaluate_with_timeout is NOT called by the production sync path — sync.rs still calls plain evaluate(). So the ReDoS protection exists but is not exercised in production (half-wired feature). Wire the timeout-bounded evaluator into the sync pipeline (with the env-tunable/default timeout), add an E2E proving a pathological rule on a crafted message warns + fails-closed without hanging sync. Follow-up to OBS-4.

OBS-4 (#360, PR #369) fixed and tested the filter ReDoS eval-timeout guard, but flagged that `crates/nuncio-filter` `evaluate_with_timeout` is NOT called by the production sync path — `sync.rs` still calls plain `evaluate()`. So the ReDoS protection exists but is not exercised in production (half-wired feature). Wire the timeout-bounded evaluator into the sync pipeline (with the env-tunable/default timeout), add an E2E proving a pathological rule on a crafted message warns + fails-closed without hanging sync. Follow-up to OBS-4.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#370