prisma-risk / tsoracle / 26380175437

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(client): bound channel pool against wire-supplied leader-hint endpoints (#383)

The channel pool seated a permanent entry on every successful dial, and
the only reclaim paths fired on failure: a failed dial (#290) and a
transport-class RPC failure (#239). A wire-supplied
`LeaderHint.leader_endpoint` that dialed successfully and never had a
transport failure was therefore retained forever. A misconfigured
cluster — or an adversarial peer pointing at a stream of distinct but
reachable decoy endpoints — could grow the map without bound, each entry
pinning a live `Channel` and its background reconnect task. Hint
endpoints are attacker-influenced strings, the same threat class as the
already-fixed failed-dial leak.

Cap non-configured (hint-derived) entries at MAX_HINT_CHANNELS via LRU
eviction keyed on each slot's last_used; configured endpoints are
operator-supplied and bounded, so they are exempt. The map value becomes
a PooledChannel pairing the cell with its last-used instant, refreshed on
every lookup (cache hits included) so the active leader — dialed on every
request — stays most-recently-used and is never the victim. The total map
size is bounded at configured.len() + MAX_HINT_CHANNELS.

Eviction only drops the map's reference; a caller mid-dial holds its own
clone of the Arc<OnceCell<Channel>>, so the channel survives until that
caller drops it, matching the existing evict_if_current contract.

Closes #341.

Coverage Stats

102 of 105 new or added lines in 1 file covered. (97.14%)

2 existing lines in 1 file now uncovered.

12441 of 13112 relevant lines covered (94.88%)

463449.18 hits per line