fix(identity): bound fan-out on the audit-info collection path

GetAuditInfo in multisig and boolpolicy accounted for one level of
composite-identity nesting but never ran validateComponentIdentities, so
the component-count bound - and with it the duplicate and none-component
checks - applied to verifier deserialization and matcher construction but
not to audit-info collection.

The depth bound does not cover that case: a single level fanning out to
thousands of components is one recursive step that resolves one audit-info
lookup per component, and descends again for any composite component. A
20 KB multisig identity with 10,000 components drove 10,001 provider
lookups with the component bound configured at 4. The path is reachable
from remote input during recipient registration.

Route both through the same choke point the other chains use, and cover
the chain in the nesting tests for depth and for fan-out at limit and
limit+1.

Signed-off-by: AkramBitar <akram@il.ibm.com>

Author: AkramBitar

docs/drivers/validation-resource-limits.md

@@ -223,6 +223,12 @@ recipient, an auditor inspecting a request, tests — and those **still get the
 running unbounded, so a seeding site added later and forgotten weakens the bound to the default
 instead of disabling it.
 
+The fan-out bound is applied on every chain above that walks a component list — verifier
+deserialization, matcher construction and audit-info collection — through the same
+`validateComponentIdentities` choke point, which also rejects an empty or duplicated component. The
+matcher-evaluation chain needs no separate check: its component count is fixed by the matcher tree
+built during construction, which was already bounded.
+
 The fan-out bound is also applied on the honest-caller path, in `multisig.WrapIdentities` and
 `boolpolicy.WrapPolicyIdentity`, so an identity constructed in-process cannot exceed what a validator
 will later accept.
@@ -269,6 +275,8 @@ of the defaults. If a deployment needs a different limit:
   panic and the expected typed error at every boundary. `fabtoken driver.FuzzOwnerVerifierNoPanic`
   additionally fuzzes the owner-identity deserialization path itself — the one reached from the
   transfer validator once per input token — seeded with identities nested from 1 to 600 levels deep.
-  Each target has a persisted seed corpus under its package's `testdata/fuzz/<TargetName>/` covering
-  every default's boundary, and runs nightly via
+  The three resource-dimension targets each have a persisted seed corpus under their package's
+  `testdata/fuzz/<TargetName>/` covering every default's boundary; `FuzzOwnerVerifierNoPanic` seeds
+  from code only, since its interesting shapes are generated (nesting depth) rather than enumerated.
+  All of them run nightly via
   [`.github/workflows/nightly-fuzz.yml`](../../.github/workflows/nightly-fuzz.yml).

token/services/identity/boolpolicy/deserializer.go

@@ -74,6 +74,12 @@ func (d *TypedIdentityDeserializer) GetAuditInfo(ctx context.Context, id driver.
 	if err = pi.Deserialize(rawIdentity); err != nil {
 		return nil, errors.Wrapf(err, "failed to unmarshal policy identity")
 	}
+	// the fan-out bound has to hold here too: this path resolves the audit info of every component
+	// in turn, which is one provider lookup each and, for a nested composite component, a further
+	// descent. The depth bound above does not cover a single level that fans out without limit.
+	if err = validateComponentIdentities(pi.Identities, driver.MaxIdentityComponentsFrom(ctx)); err != nil {
+		return nil, errors.Wrap(err, "invalid policy identity")
+	}
 	ai := &AuditInfo{IdentityAuditInfos: make([]IdentityAuditInfo, len(pi.Identities))}
 	for k, compID := range pi.Identities {
 		ai.IdentityAuditInfos[k].AuditInfo, err = p.GetAuditInfo(ctx, compID)

token/services/identity/boolpolicy/nesting_test.go

@@ -235,3 +235,85 @@ func TestWrapPolicyIdentity_RejectsExcessiveFanOut(t *testing.T) {
 	_, err = WrapPolicyIdentity("$0", toIdentities(distinctIdentities(max+1))...)
 	require.ErrorIs(t, err, tdriver.ErrTooManyIdentityComponents)
 }
+
+// stubAuditInfoProvider is a driver.AuditInfoProvider that records its lookups and, optionally,
+// resolves a composite identity by re-entering the deserializer the way the production provider does.
+type stubAuditInfoProvider struct {
+	calls int
+	fn    func(context.Context, tdriver.Identity) ([]byte, error)
+}
+
+func (s *stubAuditInfoProvider) GetAuditInfo(ctx context.Context, id tdriver.Identity) ([]byte, error) {
+	s.calls++
+	if s.fn != nil {
+		return s.fn(ctx, id)
+	}
+
+	return nil, nil
+}
+
+// The fan-out bound must be enforced on the audit-info collection path too. It resolves one provider
+// lookup per component, and a composite component descends further, so a single level that fans out
+// without limit is unbounded work that the depth bound does not cover.
+func TestGetAuditInfo_RejectsExcessiveFanOut(t *testing.T) {
+	const maxComponents = 4
+	ctx := tdriver.WithIdentityNestingLimits(context.Background(), 5, maxComponents)
+
+	p := &stubAuditInfoProvider{}
+	d := NewTypedIdentityDeserializer(nil, nil)
+
+	raw, err := (&PolicyIdentity{Policy: "$0", Identities: distinctIdentities(maxComponents + 1)}).Bytes()
+	require.NoError(t, err)
+
+	_, err = d.GetAuditInfo(ctx, token.Identity("owner"), Policy, raw, p)
+	require.ErrorIs(t, err, tdriver.ErrTooManyIdentityComponents)
+	assert.Equal(t, 1, p.calls,
+		"only the cache probe for the composite identity itself may run before the bound is enforced")
+}
+
+func TestGetAuditInfo_AllowsFanOutAtTheLimit(t *testing.T) {
+	const maxComponents = 4
+	ctx := tdriver.WithIdentityNestingLimits(context.Background(), 5, maxComponents)
+
+	p := &stubAuditInfoProvider{}
+	d := NewTypedIdentityDeserializer(nil, nil)
+
+	raw, err := (&PolicyIdentity{Policy: "$0", Identities: distinctIdentities(maxComponents)}).Bytes()
+	require.NoError(t, err)
+
+	_, err = d.GetAuditInfo(ctx, token.Identity("owner"), Policy, raw, p)
+	require.NoError(t, err)
+	assert.Equal(t, 1+maxComponents, p.calls)
+}
+
+// The depth bound holds on the audit-info collection path as well: the provider resolves an unstored
+// composite component by re-entering this deserializer, which is the recursion the bound covers.
+func TestGetAuditInfo_RejectsExcessiveDepth(t *testing.T) {
+	const maxDepth = 3
+	ctx := tdriver.WithIdentityNestingLimits(context.Background(), maxDepth, 16)
+
+	d := NewTypedIdentityDeserializer(nil, nil)
+	p := &stubAuditInfoProvider{}
+	// the guard keeps the cache probe for an identity already being resolved from looping back into
+	// it; production has the same shape, the provider only descends into components
+	resolving := map[string]bool{}
+	p.fn = func(ctx context.Context, id tdriver.Identity) ([]byte, error) {
+		if resolving[string(id)] {
+			return nil, nil
+		}
+		ti, err := identity.UnmarshalTypedIdentity(id)
+		if err != nil || ti.Type != Policy {
+			return nil, nil //nolint:nilerr // a non-policy component is the leaf, nothing stored
+		}
+		resolving[string(id)] = true
+
+		return d.GetAuditInfo(ctx, id, Policy, ti.Identity, p)
+	}
+
+	deep := nestedPolicy(t, maxDepth+2, []byte("leaf"))
+	ti, err := identity.UnmarshalTypedIdentity(deep)
+	require.NoError(t, err)
+
+	_, err = d.GetAuditInfo(ctx, deep, Policy, ti.Identity, p)
+	require.ErrorIs(t, err, tdriver.ErrIdentityNestingTooDeep)
+}

token/services/identity/multisig/deserializer.go

@@ -74,6 +74,12 @@ func (d *TypedIdentityDeserializer) GetAuditInfo(ctx context.Context, id driver.
 	if err != nil {
 		return nil, errors.Wrapf(err, "failed to unmarshal mid")
 	}
+	// the fan-out bound has to hold here too: this path resolves the audit info of every component
+	// in turn, which is one provider lookup each and, for a nested composite component, a further
+	// descent. The depth bound above does not cover a single level that fans out without limit.
+	if err := validateComponentIdentities(mid.Identities, driver.MaxIdentityComponentsFrom(ctx)); err != nil {
+		return nil, errors.Wrap(err, "invalid multisig identity")
+	}
 	auditInfo := &AuditInfo{}
 	auditInfo.IdentityAuditInfos = make([]IdentityAuditInfo, len(mid.Identities))
 	for k, identity := range mid.Identities {

token/services/identity/multisig/nesting_test.go

@@ -230,3 +230,75 @@ func TestWrapIdentities_RejectsExcessiveFanOut(t *testing.T) {
 	_, err = WrapIdentities(distinctIdentities(max + 1)...)
 	require.ErrorIs(t, err, tdriver.ErrTooManyIdentityComponents)
 }
+
+// The fan-out bound must be enforced on the audit-info collection path too. It resolves one provider
+// lookup per component, and a composite component descends further, so a single level that fans out
+// without limit is unbounded work that the depth bound does not cover.
+func TestGetAuditInfo_RejectsExcessiveFanOut(t *testing.T) {
+	const maxComponents = 4
+	ctx := tdriver.WithIdentityNestingLimits(context.Background(), 5, maxComponents)
+
+	p := &mock.AuditInfoProvider{}
+	// nothing stored for the composite identity itself, so it is assembled from its components
+	p.GetAuditInfoReturns([]byte("audit-info"), nil)
+	p.GetAuditInfoReturnsOnCall(0, nil, nil)
+
+	d := NewTypedIdentityDeserializer(nil, nil)
+	raw, err := (&MultiIdentity{Identities: distinctIdentities(maxComponents + 1)}).Bytes()
+	require.NoError(t, err)
+
+	_, err = d.GetAuditInfo(ctx, token.Identity("owner"), Multisig, raw, p)
+	require.ErrorIs(t, err, tdriver.ErrTooManyIdentityComponents)
+	assert.Equal(t, 1, p.GetAuditInfoCallCount(),
+		"only the cache probe for the composite identity itself may run before the bound is enforced")
+}
+
+func TestGetAuditInfo_AllowsFanOutAtTheLimit(t *testing.T) {
+	const maxComponents = 4
+	ctx := tdriver.WithIdentityNestingLimits(context.Background(), 5, maxComponents)
+
+	p := &mock.AuditInfoProvider{}
+	p.GetAuditInfoReturns([]byte("audit-info"), nil)
+	p.GetAuditInfoReturnsOnCall(0, nil, nil)
+
+	d := NewTypedIdentityDeserializer(nil, nil)
+	raw, err := (&MultiIdentity{Identities: distinctIdentities(maxComponents)}).Bytes()
+	require.NoError(t, err)
+
+	_, err = d.GetAuditInfo(ctx, token.Identity("owner"), Multisig, raw, p)
+	require.NoError(t, err)
+	assert.Equal(t, 1+maxComponents, p.GetAuditInfoCallCount())
+}
+
+// The depth bound holds on the audit-info collection path as well: the provider resolves an unstored
+// composite component by re-entering this deserializer, which is the recursion the bound covers.
+func TestGetAuditInfo_RejectsExcessiveDepth(t *testing.T) {
+	const maxDepth = 3
+	ctx := tdriver.WithIdentityNestingLimits(context.Background(), maxDepth, 16)
+
+	p := &mock.AuditInfoProvider{}
+	d := NewTypedIdentityDeserializer(nil, nil)
+	// a provider that has nothing stored and resolves a composite identity through the deserializer.
+	// The guard keeps the cache probe for an identity already being resolved from looping back into
+	// it; production has the same shape, the provider only descends into components.
+	resolving := map[string]bool{}
+	p.GetAuditInfoCalls(func(ctx context.Context, id tdriver.Identity) ([]byte, error) {
+		if resolving[string(id)] {
+			return nil, nil
+		}
+		ti, err := identity.UnmarshalTypedIdentity(id)
+		if err != nil || ti.Type != Multisig {
+			return nil, nil //nolint:nilerr // a non-multisig component is the leaf, nothing stored
+		}
+		resolving[string(id)] = true
+
+		return d.GetAuditInfo(ctx, id, Multisig, ti.Identity, p)
+	})
+
+	deep := nestedMultisig(t, maxDepth+2, token.Identity("leaf"))
+	ti, err := identity.UnmarshalTypedIdentity(deep)
+	require.NoError(t, err)
+
+	_, err = d.GetAuditInfo(ctx, deep, Multisig, ti.Identity, p)
+	require.ErrorIs(t, err, tdriver.ErrIdentityNestingTooDeep)
+}