oscerd opened a new issue, #154: URL: https://github.com/apache/camel-kit/issues/154
Tracking issue for verification item **V2** of the Camel-Kit security model (apache/camel-kit#6, part of the acceptance of #5), from maintainer answer Q2. **Claims it verifies.** §4.8 P1 and P11: graph analysis reads only inside the analysed root and always finishes in bounded time and memory. **Work.** Verify or add: confinement of file reads to the analysed root when the tree contains symbolic links (file symlinks are not checked today); the POM parser under the 60 s per-parser timeout (`GraphBuilder` runs it outside the timeout); a memory or file-size bound for parsed inputs. **Interim triage** while open: a demonstrated outside-root read, non-termination or unbounded memory is `VALID`. **Done when** the controls exist with tests and §4.14.2 and the YAML sidecar mark V2 verified. This is a §4.12 trigger: update the security model in the same PR. _AI-generated by Claude Code (Claude Fable 5.1) on behalf of @oscerd._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
