fix: bound three unbounded file reads (resolves self-scan Critical)

[hyperpolymath]

Summary

Self-scanning panic-attack with the latest release surfaced a Critical UnboundedAllocation in attestation/mod.rs::verify_attestation_file — and, on closer inspection, two sibling sites the analyzer's per-file heuristic glossed over. All three were the last residual violations of the codebase-wide invariant that every file read must be capacity-bounded.

Discovery path

Ran the freshly-built release of panic-attack on its own source tree:

./target/release/panic-attack assail . --output /tmp/panic-self-scan.json

Among the 12 findings, one Critical pointed at src/attestation/mod.rs — the heuristic correctly fired because that file has zero other .take(...) calls. The other two sites (src/assemblyline.rs:120, src/assail/mod.rs:230) live in files that DO use .take(...) elsewhere, so the analyzer's per-file all-or-nothing classifier flagged them as bounded overall. Manual triage caught those — separate concern, doesn't need analyzer changes here.

Fixes

All three follow the established pattern of every other read in the codebase (File::open + .take(LIMIT) + .read_to_string).

Site	Cap	Rationale
src/attestation/mod.rs::verify_attestation_file	16 MiB	JSON envelopes embed three hashes plus a small signature; legitimate envelopes < 1 MiB.
src/assemblyline.rs::load_cache_file	256 MiB	Fingerprint caches grow with estate size; large enough for multi-thousand-repo rollups.
src/assail/mod.rs::load_user_classifications	4 MiB	Hand-edited audit a2ml registries are small.

Verification

• cargo build --bin panic-attack --features signing,http — clean
• cargo clippy --all-targets --features signing,http -- -D warnings — clean
• cargo test --bin panic-attack --features signing,http — 236 passed, 0 failed
• cargo fmt --check — clean
• Self-scan before: 12 findings (1 Critical UnboundedAllocation)
• Self-scan after: 11 findings (Critical resolved; residuals are intentional — examples/vulnerable_program.rs unsafe blocks, test unwraps, etc.)
• GPG-signed commit

Out of scope

The analyzer's per-file heuristic for read_to_string boundedness is correct-by-default (files that use .take(...) are probably bounded throughout), but the two sites it missed argue for a per-call check. That's a detector improvement, separate from these data-path fixes; would file as a follow-up if the team thinks it's worth it.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 48 issues detected

Severity	Count
🔴 Critical	4
🟠 High	16
🟡 Medium	28

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/panic-attack/panic-attack/reports/panic-attack-20260211180017.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/chain.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/evidence.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/ambush/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/kanren/strategy.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (3 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/panic-attack/panic-attack/src/axial/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/assail/analyzer.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (4 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence