Security: Atomic-write boundary test masks timeout with a double poll #1300

Open
opened 2026-10-07 02:46:01 +00:00 by kayg · 1 comment
Owner

Defensive security boundary test case. Severity: minor (test cleanup panic; no server crash or authorization bypass found).

Steps: run cargo test -p calternal-plugin-files -- --test-threads=4 on branch job/bash-security after origin/dev 3601719b80. The test internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm runs 1,000 real atomic writes and four reconciles. Its five-minute completion deadline expires under parallel build load.

Expected: stop every worker, then report the original deadline failure. A consumed JoinHandle must never be polled again. Keep the existing workload, deadline and assertions.

Actual: the failure cleanup loop aborts and awaits the watcher. The unconditional watcher cleanup then awaits that same handle again. Tokio panics with JoinHandle polled after completion, masking the timeout.

Evidence: artifacts/bash-security/test-files.log, lines 283–298. Full suite result: 261 passed, 1 failed, 4 ignored, finished in 436.60s. Source: crates/plugins/files/src/lib.rs, completion cleanup in the named test.

The repair can stay in test-only cleanup. Add a deterministic cancellation-path regression that does not wait five minutes. No production behavior or existing test expectation needs to change.

Defensive security boundary test case. Severity: minor (test cleanup panic; no server crash or authorization bypass found). Steps: run `cargo test -p calternal-plugin-files -- --test-threads=4` on branch job/bash-security after origin/dev 3601719b80a39f712daf07b37879b22929dfffa0. The test `internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm` runs 1,000 real atomic writes and four reconciles. Its five-minute completion deadline expires under parallel build load. Expected: stop every worker, then report the original deadline failure. A consumed JoinHandle must never be polled again. Keep the existing workload, deadline and assertions. Actual: the failure cleanup loop aborts and awaits the watcher. The unconditional watcher cleanup then awaits that same handle again. Tokio panics with `JoinHandle polled after completion`, masking the timeout. Evidence: artifacts/bash-security/test-files.log, lines 283–298. Full suite result: 261 passed, 1 failed, 4 ignored, finished in 436.60s. Source: crates/plugins/files/src/lib.rs, completion cleanup in the named test. The repair can stay in test-only cleanup. Add a deterministic cancellation-path regression that does not wait five minutes. No production behavior or existing test expectation needs to change.
Author
Owner

The failure cleanup now aborts/joins unfinished write and scan workers, then aborts/joins the watcher exactly once outside that branch. Workload, deadline and original assertions are unchanged. Comments state which handles may already have been consumed.

Two deterministic regressions use pending scan/watcher tasks and a writer that was already joined. The exact helper and tests were extracted from the crate for a fast standalone Tokio run. Before: 1 passed, 1 failed with JoinHandle polled after completion, 0.00s. After: 2 passed, 0 failed, 0.00s. Evidence: artifacts/bash-security/storm-cleanup-before.rs, storm-cleanup-before.log, storm-cleanup-after.rs, storm-cleanup-after.log.

cargo fmt --check passed. Updated per-crate clippy/test gates and the performance guard check have started; compilation waits for the own server build. This fixes the cleanup panic. It does not certify the unrelated stress test's throughput budget under host load.

The failure cleanup now aborts/joins unfinished write and scan workers, then aborts/joins the watcher exactly once outside that branch. Workload, deadline and original assertions are unchanged. Comments state which handles may already have been consumed. Two deterministic regressions use pending scan/watcher tasks and a writer that was already joined. The exact helper and tests were extracted from the crate for a fast standalone Tokio run. Before: 1 passed, 1 failed with `JoinHandle polled after completion`, 0.00s. After: 2 passed, 0 failed, 0.00s. Evidence: `artifacts/bash-security/storm-cleanup-before.rs`, `storm-cleanup-before.log`, `storm-cleanup-after.rs`, `storm-cleanup-after.log`. `cargo fmt --check` passed. Updated per-crate clippy/test gates and the performance guard check have started; compilation waits for the own server build. This fixes the cleanup panic. It does not certify the unrelated stress test's throughput budget under host load.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1300
No description provided.