Affected version: Servy 7.9.0 (Servy.psm1, Servy.psd1 ModuleVersion = '7.9.0')
Servy.psm1 declares:
[ValidateRange(1, 2147483647)]
[int] $MaxRestartAttempts,
but the CLI binary enforces [1, 100] via AppConfig.MaxMaxRestartAttempts. As a result, the PowerShell wrapper happily accepts values like 5000 or 999999999, passes them to servy-cli.exe, and the user gets a CLI-side failure that's much harder to diagnose than a clean PowerShell ValidateRange rejection would be.
Several other [int] parameters in Servy.psm1 use the same [ValidateRange(1, 2147483647)] or [ValidateRange(0, 2147483647)] pattern:
HeartbeatIntervalMaxFailedChecksRotationSizeMaxRotationsStartTimeoutStopTimeoutPreLaunchTimeoutPreStopTimeoutPreLaunchRetryAttempts
All of them should be audited against their actual AppConfig bounds to confirm the module's declared range matches what the CLI will accept at runtime.
Request: Either have the PowerShell module read constants from a shared location (e.g. generate from AppConfig), or hard-code the correct per-parameter ranges in Servy.psm1 to match the CLI. Today the module over-promises what it accepts.
Affected version: Servy 7.9.0 (
Servy.psm1,Servy.psd1ModuleVersion = '7.9.0')Servy.psm1declares:but the CLI binary enforces
[1, 100]viaAppConfig.MaxMaxRestartAttempts. As a result, the PowerShell wrapper happily accepts values like5000or999999999, passes them toservy-cli.exe, and the user gets a CLI-side failure that's much harder to diagnose than a clean PowerShellValidateRangerejection would be.Several other
[int]parameters inServy.psm1use the same[ValidateRange(1, 2147483647)]or[ValidateRange(0, 2147483647)]pattern:HeartbeatIntervalMaxFailedChecksRotationSizeMaxRotationsStartTimeoutStopTimeoutPreLaunchTimeoutPreStopTimeoutPreLaunchRetryAttemptsAll of them should be audited against their actual
AppConfigbounds to confirm the module's declared range matches what the CLI will accept at runtime.Request: Either have the PowerShell module read constants from a shared location (e.g. generate from
AppConfig), or hard-code the correct per-parameter ranges inServy.psm1to match the CLI. Today the module over-promises what it accepts.