You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@burr.apache.org by GitBox <gi...@apache.org> on 2026/10/04 20:32:44 UTC

[GH] (burr/fix/safe-expr-bounds): Workflow run "Build Burr" failed!

The GitHub Actions job "Build Burr" on burr.git/fix/safe-expr-bounds has failed.
Run started by GitHub user elijahbenizzy (triggered by elijahbenizzy).

Head commit for run:
b96dea16ca4239febfb76d7c62a646421d3e8ea5 / Elijah Ben Izzy <el...@users.noreply.github.com>
fix(core): bound arithmetic and sequence sizes in safe_expr

Condition.safe_expr() allowed a handful of operators whose result size is
not bounded by the size of the expression: int ** int, sequence * n,
sequence + sequence, and printf-style % on strings. Bound them:

- at most 500 AST nodes per expression (checked before the recursive
  validator runs)
- int ** int: |exponent| <= 64 and base <= 64 bits; non-numeric operands
  rejected; float ** left to Python (bounded by float range)
- sequence * n: n <= 10_000 and result <= 1_000_000 elements; same result
  cap for sequence + sequence
- % is no longer applied to strings
- general backstop: no arithmetic step or int literal wider than 4096 bits

Literal-only subexpressions (e.g. 10 ** 10 ** 10) are checked at
safe_expr() call time; state-dependent values raise ValueError from run().
Docstring updated and tests added for each bound.

Report URL: https://github.com/apache/burr/actions/runs/37232405251

With regards,
GitHub Actions via GitBox