Category

Test Quality / Security

Severity

Critical

Location

crates/agnix-core/src/parsers/markdown.rs:18-95

Description

The MAX_REGEX_INPUT_SIZE constant (64KB) protects against ReDoS attacks, but boundary conditions are not adequately tested:

1. Content at exactly 65,536 bytes (should be accepted)
2. Content at 65,537 bytes (should be rejected)
3. Pathological patterns near the limit (nested XML tags at boundary)
4. extract_imports is NOT subject to the limit but no test verifies it handles >64KB

Current test only checks MAX_REGEX_INPUT_SIZE + 1000, not the exact boundary.

Suggested Tests

#[test]
fn test_extract_xml_tags_exactly_at_64kb_limit() {
    let content = format!("<tag>{}</tag>", "x".repeat(MAX_REGEX_INPUT_SIZE - 12));
    assert_eq!(content.len(), MAX_REGEX_INPUT_SIZE);
    let tags = extract_xml_tags(&content);
    assert!(!tags.is_empty()); // Should process
}

#[test]
fn test_extract_xml_tags_one_byte_over_limit() {
    let content = "x".repeat(MAX_REGEX_INPUT_SIZE + 1);
    let tags = extract_xml_tags(&content);
    assert!(tags.is_empty()); // Should skip
}

Effort

Small

Found by /audit-project multi-agent review