Release: security audit fixes (M1, M2, L1-L5, I1) #2

Merged

hannah-vernon merged 2 commits from dev into main

2026-06-11 17:37:12 -05:00

hannah-vernon commented

2026-06-11 17:36:53 -05:00

Owner

What does this PR do?

Promotes the security-hardening work from dev to main. This release implements all fixes recommended by the AI security audit (findings M1, M2, L1-L5, I1). Merged via PR #1.

Highlights

FileTailer (M1, L4): bounded chunked reads and a capped in-progress line buffer (no memory exhaustion on huge or newline-free files); IO/access errors surfaced via LastError.
FolderTailer (M2, L1-L4): event-driven discovery with a throttled rescan; enumeration and reads moved outside the lock; 4096-file cap; volatile cross-thread flags; recursive scans skip reparse points (junctions / symlinks); 250 ms regex match timeout; non-fatal Notice events with de-duplication.
FolderWindow (L5, L4): persisted window bounds clamped to the virtual screen with a minimum size; Notice messages shown in the status bar; start task observed for faults.
SettingsService (I1): atomic File.Move replace when saving settings.
Housekeeping: removed accidentally committed __tailtest harness files, ignored the folder, documented the new limits in README.md.

How was this tested?

dotnet build Tayler.slnx -c Debug - 0 errors, 0 warnings (WarningsAsErrors active).
Throwaway harness compiling the actual tailer sources: 11/11 checks passed (initial lines, append follow, partial-line reassembly, truncation reset, follow-only, new-file discovery, glob filtering).

Checklist

I have read the Contributing Guide
Changes are focused - one logical change per PR
Documentation updated (README limits section)
New dependencies are MIT/Apache-2.0 and security-vetted (no new dependencies)
No commented-out code or debug leftovers

## What does this PR do? Promotes the security-hardening work from `dev` to `main`. This release implements all fixes recommended by the AI security audit (findings M1, M2, L1-L5, I1). Merged via PR #1. ### Highlights - **FileTailer (M1, L4):** bounded chunked reads and a capped in-progress line buffer (no memory exhaustion on huge or newline-free files); IO/access errors surfaced via `LastError`. - **FolderTailer (M2, L1-L4):** event-driven discovery with a throttled rescan; enumeration and reads moved outside the lock; 4096-file cap; volatile cross-thread flags; recursive scans skip reparse points (junctions / symlinks); 250 ms regex match timeout; non-fatal `Notice` events with de-duplication. - **FolderWindow (L5, L4):** persisted window bounds clamped to the virtual screen with a minimum size; `Notice` messages shown in the status bar; start task observed for faults. - **SettingsService (I1):** atomic `File.Move` replace when saving settings. - **Housekeeping:** removed accidentally committed `__tailtest` harness files, ignored the folder, documented the new limits in `README.md`. ## How was this tested? - [x] `dotnet build Tayler.slnx -c Debug` - 0 errors, 0 warnings (WarningsAsErrors active). - [x] Throwaway harness compiling the actual tailer sources: 11/11 checks passed (initial lines, append follow, partial-line reassembly, truncation reset, follow-only, new-file discovery, glob filtering). ## Checklist - [x] I have read the [Contributing Guide](../CONTRIBUTING.md) - [x] Changes are focused - one logical change per PR - [x] Documentation updated (README limits section) - [x] New dependencies are MIT/Apache-2.0 and security-vetted (no new dependencies) - [x] No commented-out code or debug leftovers

hannah-vernon added 2 commits

2026-06-11 17:36:53 -05:00

Implement security audit fixes (M1, M2, L1-L5, I1) 02ec1de522

Address findings from the AI security audit:

- M1/L4 (FileTailer): chunked bounded reads (1 MiB) and a capped
  in-progress line buffer so a very large append or a newline-free file
  cannot exhaust memory; surface IO/access errors via LastError instead
  of swallowing them.
- M2/L1/L2/L3/L4 (FolderTailer): event-driven discovery with a throttled
  full rescan; enumeration and file reads moved outside the lock; 4096
  file cap; volatile cross-thread flags; recursive scans skip reparse
  points (junctions / symlinks); regex matching uses a 250 ms timeout;
  non-fatal conditions raised via a new Notice event with de-duplication.
- L5 (FolderWindow): clamp persisted window bounds to the virtual screen
  and enforce a minimum size before applying.
- L4 (FolderWindow): subscribe to FolderTailer.Notice and surface
  messages in the status bar; observe the Start task for faults.
- I1 (SettingsService): atomic File.Move replace instead of Copy+Delete.

Also remove accidentally committed __tailtest harness files, ignore the
folder, and document the new limits in README.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>