AlexStocks opened a new pull request, #3575:
URL: https://github.com/apache/dubbo-go/pull/3575
## What
Resolves the ๐ด blocker from the security review: the **script router**
executes user-provided JavaScript via goja with **no execution deadline**, so a
runaway/looping script (e.g. `while (true) {}`) blocks the routing goroutine
forever โ **denial of service**. See `CODE_REVIEW_GUIDE.md ยง4.2.2` and issue
#3566.
### Code fix โ `cluster/router/script/instance/js_instance.go`
Wrap `RunProgram` with a watchdog:
- `defaultScriptTimeout = 500ms` constant.
- `time.AfterFunc(timeout, func() { rt.Interrupt("...") })` + `defer
timer.Stop()`.
- `initCallArgs` already calls `ClearInterrupt` before each run, which also
clears any stale interrupt.
### Regression test โ `cluster/router/script/instance/js_instance_test.go`
`TestRunScriptTimeout` compiles `while (true) {}` and asserts `runScript`
returns an **error** within the watchdog (instead of hanging). Guards against a
future regression of the dead/missing timeout.
### Docs & governance (supporting #3566)
- `CODE_REVIEW_GUIDE.md`: adds ยง4.2.2 (mandatory interrupt timeout for any
external script execution). The code comment references it, so the rule is not
a dangling reference.
- `CODEOWNERS`: activates review routing. **Note:** the `@dubbo-go/*`
handles are **placeholders** โ they must be replaced with real team/personal
handles before GitHub actually routes review (GitHub does not route until
then). Flagged so a Committer can fill them in.
## Verification
- `go vet ./cluster/router/script/instance/`
- `go test ./cluster/router/script/instance/ -run TestRunScriptTimeout -v` โ
`PASS (0.55s)` (no hang).
- `go build ./cluster/router/script/instance/` (Go 1.25).
## Out of scope (left for separate PRs)
The audit's CI/governance changes (`.golangci.yml` enabling `gosec`,
`Makefile` adding `test-race`/`vulncheck`, `.github/workflows` CI steps) and
the metrics/probe exposure hardening are **not** included here to keep this PR
focused on the script-router DoS; they will be raised separately.
Fixes: #3566
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
