Repository navigation
Rust #325: refuse policy maps that are not JSON objects, like PHP #705 - #719
Conversation
The six admission, durable-limit and external-payload policy maps are read like PHP's EnvAuditor::jsonObject: unset, or raw text that decodes to a JSON object. Malformed JSON, null, lists and scalars now stop startup instead of silently becoming an empty policy. A set DW_ name wins over its legacy name even when invalid, and the refusal names the variable without its value. The external payload quota reads its overrides with the same decoder.
|
Security focused source review at exact fe8269b: accepted in principle. The six policy maps now fail closed on malformed or non-object JSON, a set primary name cannot silently fall back to a valid legacy value, the startup audit runs before runtime construction, and refusals identify only the canonical/source variable names without echoing values. Valid empty objects and the one native-honored external-payload object remain accepted; the other five still refuse nonempty policies native cannot implement. This matches PHP #705 at the requested syntax/shape boundary without expanding native policy behavior. Final acceptance still requires the exact-head normal checks and current-main integration; the next released-image parity remains coupled to the broader #673/#708 publication train. No native/shared/frozen scope expansion or publication disposition is implied. |
|
Pre-integration head |
|
Ports PHP #705 to native (#325). Published PHP silently turned malformed admission-policy JSON into an empty policy, so a configured cap could disappear. Native had the same defect:
DW_TASK_QUEUE_ADMISSION_OVERRIDESandDW_NAMESPACE_ADMISSION_OVERRIDESaccepted malformed JSON.null,[], booleans and numbers.DW_EXTERNAL_PAYLOAD_NAMESPACE_OVERRIDES, which native honors, became an empty policy when malformed.Change
The six maps PHP now reads with
EnvAuditor::jsonObjectfollow the same rule inconfig_audit::json_object:env()conversions do not apply;DW_*name wins over its legacy name even when theDW_*value is invalid;Native still refuses a non-empty object for the five maps it has no policy for. The external payload quota now reads its overrides with the same decoder.
Reference
This follows PHP main
f67f2816e(#705), not the published 2.11.1 image. Every valid configuration behaves the same under both. The only values now refused are ones published PHP silently discarded and the next PHP image refuses at boot. Native, shared, frozen and OpenAPI contract bytes outsiderust/src/config_audit.rsandrust/src/runtime/external_config.rsare unchanged.Verification
cargo check --locked --all-targets: clean.cargo test --lib config_audit: 12/12 pass, including the newpolicy_maps_must_be_json_objects_like_php_705. It covers all six maps under both names, 17 invalid values, padded{}, DW-over-legacy precedence in both directions, and that the refusal never repeats the value.Checkpoint:
docs/rust-server-port-checkpoints/2026-10-23-policy-map-json.md.