34385140379
92%

Ran 09 Sep 2026 05:48PM UTC

Jobs 1

Files 17

Run time 1min

Badge

Embed ▾

Committed 09 Sep 2026 05:48PM UTC coverage: 95.247% (+0.2%) from 95.02%

Build # 34385140379

Build Type

push

github

Committed by

web-flow

Commit Message

fix: cap how far a pushed message may inflate (#22)

Inflate finished with gzip.CopyTo into an unbounded MemoryStream. It now
copies through a fixed buffer with a running total and abandons past
512KB.

This is the one finding where Link is the weaker of the two apps. Hand
verifies its GCM tag with a key only the handset and Reach hold, so a
forged payload never reaches its inflate. Here the content key is
RSA-OAEP wrapped to the handset's public key, which the device publishes
at enrolment - so anyone holding it can mint a content key, seal a bomb
under it and produce an envelope that authenticates perfectly. The tag
gates nothing against this.

Bounded even before the cap: FCM tops a payload out at 4KB and gzip near
1000:1, so roughly 4MB of allocation inside a push handler on a phone -
memory pressure and a dropped message rather than a crash. Cheap to
remove all the same.

The new test seals through the ordinary path, so its envelope is valid
in every respect and still fits in an FCM data message.

Coverage Stats

982 of 1031 relevant lines covered (95.25%)

10.73 hits per line

Coverage Regressions

Lines	Coverage	∆	File
3	88.46	3.95%	Models/MessagePayloadCipher.cs

Jobs

ID	Job ID	Ran	Files	Coverage
1	34385140379.1	09 Sep 2026 05:48PM UTC	17	95.25	GitHub Action Run

bleedingdeacons / link / 34385140379
92%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 34385140379

bleedingdeacons / link / 34385140379 92%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 34385140379

bleedingdeacons / link / 34385140379
92%

README BADGES
x