Sergey Kozyrenko 7cd22ccbc9 test(docker,flows): cover the listing cap paths, bound the container-list path count ...

The truncation slice and the demux stdout byte-cap had no docker-layer tests —
only the handler's Truncated wiring was exercised through the fake, so a
mis-slice or a dropped cap would have gone unnoticed. Extract find-output
parsing into a pure parseFindEntries and take the byte cap as a demuxExecStdout
parameter, then unit-test both boundaries (at cap / cap+1 / over-limit stream).

Also bound how many paths one container-files request may list
(maxContainerListPaths), so the per-path entry cap can't be multiplied by an
attacker-chosen path count into a large fan-out or response body.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-12 23:22:33 +07:00

..

client_listing_test.go

test(docker,flows): cover the listing cap paths, bound the container-list path count

2026-07-12 23:22:33 +07:00

client_statfanout_test.go

feat(docker): partial-success container listing instead of fail-fast

2026-07-12 13:32:48 +07:00

client.go

test(docker,flows): cover the listing cap paths, bound the container-list path count

2026-07-12 23:22:33 +07:00