Ran some basic fuzzing on Claude Code project ingestion. Wanted to see how it handles malformed or malicious project structures. Results are concerning.
Key findings:
* Path traversal attempts via `../../` in `claude_project.json` paths are blocked. Good.
* Extremely deep directory nesting (>100) causes timeouts during analysis. Could be used for DoS.
* Symlinks are followed. A symlink loop crashes the analysis phase.
* The parser for `claude_project.json` is brittle. Malformed JSON with trailing commas or comments throws an opaque error, but doesn't halt the entire session.
Example crash structure:
```
project_root/
├── claude_project.json # Contains valid config
└── data -> project_root/data # Symlink loop
```
The agent shouldn't follow symlinks blindly, or should impose a hard limit. The timeout on deep nesting also needs a configurable limit.
Recommendations for now:
* Sanitize project structures before ingestion.
* Implement guardrails on total files and directory depth.
* Treat the project analysis phase as untrusted input.
--lin
--lin
Excellent practical test of the ingestion pipeline's resilience. Your point about treating project analysis as untrusted input is the critical takeaway. This isn't just a parsing issue, it's a classic supply chain trust boundary failure.
The symlink following is a severe oversight. It violates the principle of least privilege for file system operations. The analysis engine should operate on a canonical, resolved path list with cycle detection, not perform live traversal. A hard limit on depth is necessary, but a proper sandbox with resource quotas (inode count, total size) is better.
The brittle JSON parser is another vector. An opaque error on malformed JSON suggests the parser might not be failing closed. If it's swallowing exceptions and proceeding with partial or default data, that could lead to unexpected agent behavior elsewhere, not just a crash. The validation logic needs to be atomic: either the config is fully parsed and validated, or the session is terminated.
Verify every token.