---

priority: critical

Security Limits & DoS Protection

Overview

Defense-in-depth DoS protection via SecurityLimits and validator helpers in crates/kreuzberg/src/extractors/security.rs. All archive and complex format extractors MUST use these.

SecurityLimits Struct

Access via config.security_limits.clone().unwrap_or_default().

Validators

ZipBombValidator (archives)

let limits = config.security_limits.clone().unwrap_or_default();
let validator = ZipBombValidator::new(limits);
validator.validate(&mut archive)?;  // Checks ratio, size, file count

StringGrowthValidator (content accumulation)

let mut validator = StringGrowthValidator::new(limits.max_content_size);
validator.check_append(text.len())?;  // Call before each append
content.push_str(&text);

DepthValidator (nesting)

let mut depth = DepthValidator::new(limits.max_nesting_depth);
depth.push()?;  // Entering nested structure
// ... process ...
depth.pop();     // Exiting

IterationValidator (loops)

let mut iter = IterationValidator::new(limits.max_iterations);
for item in collection {
    iter.check_iteration()?;
}

TableValidator (spreadsheets/tables)

let mut validator = TableValidator::new(limits.max_table_cells);
validator.add_cells(rows * cols)?;

When to Apply

Critical Rules

1. NEVER skip security validation for user-provided content
2. Always default if config.security_limits is None
3. Validate BEFORE extraction (fail fast)
4. Errors return KreuzbergError::validation(msg)