Guard OTLP attribute merge against allocation-size overflow

[Copilot]

Code scanning flagged an integer-overflow risk in OTLP custom attribute merging. This change hardens the allocation path so extremely large input maps cannot overflow the capacity calculation and panic during merge.

• Overflow guard in OTLP attribute merging

  • Replaced the raw len(base) + len(override) capacity hint in mergeOTLPCustomAttributes with a bounded helper.
  • Returns the summed capacity when it fits in int; otherwise falls back to 0 so the merge remains correct without unsafe preallocation.

• Focused regression coverage

  • Added targeted tests for:
    • zero-length inputs
    • normal merged sizes
    • the exact math.MaxInt boundary
    • overflow cases just past the safe boundary

funcmergedOTLPCustomAttributesCapacity(baseLen, overrideLenint) int {
ifbaseLen>math.MaxInt-overrideLen {
return0
}
returnbaseLen+overrideLen
}

[pelikhan]

@copilot create a helper to allocate array size to be reuse on every allocation site to avoid security warning.

[Copilot]

@copilot create a helper to allocate array size to be reuse on every allocation site to avoid security warning.

Fixed in e861607. I added a reusable safeAllocationCapacity(...) helper in pkg/workflow and switched the additive map/slice preallocation hints in this package, including the OTLP merge path, to use it.

[Copilot]

Pull request overview

This PR hardens slice/map preallocation across the pkg/workflow package to avoid int overflow when computing capacity hints (e.g., len(a)+len(b)), including the originally flagged OTLP custom attribute merge path.

Changes:

• Introduce safeAllocationCapacity(...int) to safely sum allocation “capacity hints” and fall back to 0 on overflow.
• Replace direct len(x)+len(y)(+n) preallocation expressions with safeAllocationCapacity(...) in multiple workflow components (OTLP merge, permissions, generators, validators).
• Add unit tests covering boundary and overflow behavior for the new helper.

Show a summary per file

File	Description
pkg/workflow/workflow_import_merge.go	Use safe capacity hint when merging imported and main job pre-steps.
pkg/workflow/tools.go	Guard preallocation when merging types lists in defaults application.
pkg/workflow/threat_detection.go	Guard map preallocation when injecting threat-detection if conditions.
pkg/workflow/safe_output_handlers.go	Guard map preallocation when building handler lookup map.
pkg/workflow/safe_jobs_needs_validation.go	Guard slice preallocation when assembling cycle descriptions.
pkg/workflow/run_step_sanitizer.go	Guard map preallocation when rebuilding env maps during sanitization.
pkg/workflow/permissions.go	Guard map preallocation when building valid permission scope set.
pkg/workflow/permissions_validation.go	Guard slice preallocation when building scope list for fuzzy matching.
pkg/workflow/observability_otlp.go	Guard OTLP custom-attributes merge map preallocation.
pkg/workflow/network_firewall_validation.go	Guard slice preallocation when collecting ecosystem identifiers.
pkg/workflow/mcp_setup_generator.go	Guard preallocation for env key list + env map during setup YAML generation.
pkg/workflow/known_action_credentials.go	Guard map preallocation when merging known-action env var sets.
pkg/workflow/domains.go	Guard slice preallocation when building default domain lists.
pkg/workflow/concurrency.go	Guard slice preallocation when building concurrency expression parts.
pkg/workflow/compiler_safe_outputs.go	Guard map/slice preallocation when merging event types.
pkg/workflow/compiler_jobs.go	Guard slice preallocation when inserting pre-steps into step list.
pkg/workflow/compiler_aw_context.go	Guard slice preallocation when injecting workflow trigger inputs.
pkg/workflow/compiler_activation_job.go	Guard slice preallocation when injecting if after name.
pkg/workflow/awf_helpers.go	Guard map preallocation when building ecosystem domain map for scripts.
pkg/workflow/allocation_helpers.go	Add safeAllocationCapacity helper to prevent int overflow in capacity hints.
pkg/workflow/allocation_helpers_test.go	Add regression tests for overflow/boundary behavior of the helper.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 21/21 changed files
• Comments generated: 1