vulns.co
/
GKData.io MCP
AP / Application

Parsers, archives, and fail-open

Review file and document processing as a chain of bounded parsing, typed validation, storage, and authorized action.

Guide 11 / 154 review notesUpdated 2026-10-11
Download .md ↓JSON ↗

The review

What to look for

Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.

  1. Define accepted meaning

    Specify supported formats, size and complexity budgets, encoding rules, and the safe typed result each parser may produce.

  2. Keep parsing contained

    Run processing with minimal privileges and isolate it from sensitive filesystem, network, and interpreter authority.

  3. Validate after parsing

    Treat parsed metadata and paths as untrusted until they satisfy an application-specific authorization and storage policy.

  4. Review failure behavior

    Ensure malformed or unsupported input produces a bounded rejection without partial state or public diagnostics.

What to produce

  • Format acceptance contract
  • Processing isolation notes
  • Failure-handling tests

Common mistakes

  • Trusting declared content type
  • Letting parsed paths select storage targets
  • Converting parser errors into permissive behavior

Continue the study

Reading & source context

Editorial notes above connect these references. Open each record for its original source and review date.

Chromium Rule of Two: input trust, memory safety and privilegeChromium Project pypdf: bound repeated work when reading embedded attachmentspy-pdf / pypdf Error Handling Cheat SheetOWASP Cheat Sheet Series

Visual models

Untrusted input is parsed with memory safety and limited privileges. A bounded typed result still requires an independent meaning and authorization check before any scoped operation; failed checks reject the request.Parsing safety and action authority ↗A failure reaches a shared error handler. The public response contains minimal generic information. A separate diagnostic path selects useful context, removes secrets and unnecessary personal data, and stores it under access and retention controls. Raw exception details do not flow directly to the client.Failures need separate public and diagnostic contracts ↗

Connected disclosures

V8 optimized object handling retained invalid type assumptionsGoogle Redis Lua object lifetime failure crossed the scripting boundaryRedis Facebook error responses exposed unintended application dataMeta (Facebook)

From the field toolkit

Archive and document parsersplaybooks ↗Exception paths and fail-openplaybooks ↗Parser differentialschecklists ↗Exception and debug pathschecklists ↗

Guide by GK Data · Research snapshot 2026-10-04.
Sources and review dates are preserved in the library provenance.

Next skillWrite the report →