leerho opened a new pull request, #781: URL: https://github.com/apache/datasketches-java/pull/781
Adds a `SECURITY.md`, adapted from the one in datasketches-cpp (apache/datasketches-cpp#545), so both libraries make the same commitments. It covers: - **Reporting:** report privately to [email protected] or [email protected], not through public issues or PRs. - **Supported versions and published vulnerabilities:** same text as C++. - **Security model:** - **Deserialization is in scope.** `heapify()`, `wrap()`, `writableWrap()`, `getInstance()` and `deserialize()` must be safe on arbitrary input. Malformed input must be rejected with a `SketchesException`. - **Java-specific definition of a vulnerability.** Java checks array and segment bounds, so the C++ wording (out-of-bounds reads and writes, undefined behavior) doesn't apply. Instead, deserializing must not: - loop forever; - allocate memory based on declared sizes that are inconsistent with the rest of the input or exceed the sketch type's documented limits; - return a sketch that hangs or fails with a non-`SketchesException` later. - **Oversized caller segments are supported.** A caller-provided `MemorySegment` larger than the sketch needs, so a direct sketch can grow in place, is allowed. Bytes beyond the serialized image must not be trusted. - **Item serializers:** an `ArrayOfItemsSerDe` written by the application is the application's responsibility. - **Out of scope:** misuse of other APIs, and adversarial bias of estimates (same as C++). Documentation only; no code changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
