fs-size-cap
Large file reads are capped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain fs-size-cap.
- pack
fs- weight
- scored
- scope
- server (response size limit)
- decided by
- response
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
checks.fs-size-cap.enabledchecks.fs-size-cap.file_mibchecks.fs-size-cap.pass_mibchecks.fs-size-cap.severitysandbox.max_mib
Probes
big-fileread {sandbox}/big.bin (64 MiB) with a 120 s timeout
Settings and thresholds
Every check also takes checks.fs-size-cap.enabled and checks.fs-size-cap.severity; they are described once in the configuration reference.
| Threshold | Default | Set with | Standard |
|---|---|---|---|
file_mib | 64 | checks.fs-size-cap.file_mib | locked |
pass_mib | 16 | checks.fs-size-cap.pass_mib | locked |
| Key | Default | Standard | Meaning |
|---|---|---|---|
checks.fs-size-cap.file_mib | 64 | locked | Size in MiB of the file fs-size-cap asks the server to read. |
checks.fs-size-cap.pass_mib | 16 | locked | Largest response in MiB that still passes fs-size-cap (standard 16). |
sandbox.max_mib | 1024 | locked | Size cap of the sandbox directory in MiB; a probe that exceeds it is aborted and fails. |
How the verdict is established
- Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.
What to fix
Cap how much of a file one call returns (a byte limit with a truncation notice, or paging) so a large file cannot flood the response. The check is inconclusive when content readers exist and none could be controlled, and n/a when no tool returns file content.
False positives
A server meant to return whole large files is graded against a limit it never promised.
False negatives
Measures the size of the response only, not memory use. A dropped connection or a timeout counts as a fail. Low stakes; not a memory-safety test.