resource-bounds-dos

Estrelas2.737

Forks699

Atualizado1 de junho de 2026 às 15:28

Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770).

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

kubernetes-sigs

kubernetes-sigs/kueue

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	resource-bounds-dos
description	Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770).
license	Apache-2.0
metadata	{"copyright":"The Kubernetes Authors"}

Skill: Resource Bounds / DoS Resistance (CWE-400, CWE-770)

Loops over user-supplied slices (PodSets, ResourceGroups, Flavors, cohort children, admission checks) without a documented webhook-enforced cap or explicit length check.
make([]T, n) / make(map[K]V, n) where n comes from user data without a sanity cap.
Outbound API or HTTP calls without context.WithTimeout (or a bounded inherited reconcile context).
Invalid .spec.interval-style fields that could wedge the reconciler for the entire kind (CVE-2022-39272 pattern). Failures from invalid CR content must surface to status, not crash-loop.
New metrics with unbounded label cardinality — workload_name, pod_name, namespace+name composites, annotation values as labels.

Mais deste repositório

mesmo repositório

was-cluster

kubernetes-sigs/kueue

Build and manage a kind cluster for Workload-Aware Scheduling (WAS) e2e tests. Use when the user wants to set up, run tests against, or tear down a WAS test cluster built from Kubernetes main.

2026-07-102.7k

avoidable-complexity

kubernetes-sigs/kueue

Flag solutions more elaborate than the problem requires — complexity that exists only because the author reached for a pattern.

2026-06-012.7k

duplicated-logic

kubernetes-sigs/kueue

Flag identical (or near-identical) blocks across types/adapters/call sites that should live in a shared helper — and newly extracted helpers with only one caller.

2026-06-012.7k

illogical-structure

kubernetes-sigs/kueue

Flag code organization that a future maintainer will struggle to follow, modify, or extend.

2026-06-012.7k

misplaced-logic

kubernetes-sigs/kueue

Flag code put somewhere a reader would not expect to find it — cleanup scattered across callers, validation deep in business logic.

2026-06-012.7k

nonsensical-decisions

kubernetes-sigs/kueue

Flag unnecessary indirection, mismatched abstractions, or confusing data flow that obscures what the code is doing.

2026-06-012.7k

name	resource-bounds-dos
description	Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770).
license	Apache-2.0
metadata	{"copyright":"The Kubernetes Authors"}

Skill: Resource Bounds / DoS Resistance (CWE-400, CWE-770)

Loops over user-supplied slices (PodSets, ResourceGroups, Flavors, cohort children, admission checks) without a documented webhook-enforced cap or explicit length check.
make([]T, n) / make(map[K]V, n) where n comes from user data without a sanity cap.
Outbound API or HTTP calls without context.WithTimeout (or a bounded inherited reconcile context).
Invalid .spec.interval-style fields that could wedge the reconciler for the entire kind (CVE-2022-39272 pattern). Failures from invalid CR content must surface to status, not crash-loop.
New metrics with unbounded label cardinality — workload_name, pod_name, namespace+name composites, annotation values as labels.