Skip to content

Do a spec-correctness hardening pass - #2696

Merged
jviotti merged 7 commits into
mainfrom
harden-a
Jul 30, 2026
Merged

Do a spec-correctness hardening pass#2696
jviotti merged 7 commits into
mainfrom
harden-a

Conversation

@jviotti

@jviotti jviotti commented Jul 30, 2026

Copy link
Copy Markdown
Member

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

Review in cubic

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
@augmentcode

augmentcode Bot commented Jul 30, 2026

Copy link
Copy Markdown
🤖 Augment PR Summary

Summary: Spec-compliance hardening across multiple parsers/serializers to more safely handle malformed inputs and tighten edge-case behavior.

Changes:

  • HTML: escape UTF-8 NBSP (U+00A0) to &nbsp; in in-place and append APIs; document non-overlapping input/output requirement.
  • HTTP: discard header field-lines/continuations containing CR/LF/NUL; adjust header serialization reserve sizing to only include emitted fields; avoid splitting list-entry parameters on semicolons inside quoted values.
  • HTTPSystemRequest: refuse headers and Content-Type values containing CR/LF/NUL as header-injection defense.
  • IDNA/IP/URI: fix IDNA label-length accounting for pure-ASCII vs A-label form; classify 192.0.0.9/.10 anycast as public; keep percent-encoding hex uppercase in canonicalized hosts.
  • JOSE/JWT: reject signing inputs with duplicate header/claim member names.
  • JSON-LD/JSON Pointer: preserve JSON-LD 1.0 processing mode through context resets and refine compaction candidate ordering; allow numeric pointer tokens to resolve object members for position tracking.
  • OIDC: drop (ignore) offline_access when prompt=none; improve WebFinger identifier normalization and fragment stripping; validate redirect URI constraints for native and web+implicit registrations and reject unknown application_type values.
  • YAML/Time: strip BOM and reject invalid UTF-8/disallowed C0 controls; fix tag-directive scoping/version validation/hex-octal parsing; ensure formatted dates always use 4-digit years (including <1000).

Technical Notes: The PR adds targeted regression tests for each tightened rule (escaping, header injection, OIDC discovery/registration, JSON-LD compaction, YAML stream validity, and date formatting).

🤖 Was this summary useful? React with 👍 or 👎

@augmentcode augmentcode Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. 2 suggestions posted.

Fix All in Augment

Comment augment review to trigger a new review at any time.

Comment thread src/core/yaml/lexer.h Outdated
std::size_t position{0};
while (position < this->input_.size()) {
const auto decoded{utf8_decode(this->input_, position)};
if (!decoded.has_value()) {

@augmentcode augmentcode Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

src/core/yaml/lexer.h:395: On !decoded.has_value() the code skips the raw byte, so a disallowed control byte in the 0x80–0x9F range could bypass is_disallowed_control if it appears as malformed UTF-8. Consider whether malformed UTF-8 should be rejected (or at least still checked for disallowed control bytes) to match YAML’s Unicode/printable-set requirements.

Severity: medium

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

return uri.is_loopback() || uri.is_localhost();
}

return uri.scheme().has_value() && !uri.is_https();

@augmentcode augmentcode Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

src/core/oidc/oidc_registration.cc:104: is_native_redirect_uri currently accepts any non-HTTPS scheme (e.g. file:/ftp:), but the spec language here is “custom URI schemes” or HTTP loopback, which may not include well-known schemes. Could this broaden the accepted redirect URI set more than intended for native clients?

Severity: medium

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

5 issues found across 45 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/html/escape.cc">

<violation number="1" location="src/core/html/escape.cc:21">
P3: The public API documentation now understates the function's behavior: no-break spaces are also converted to `&nbsp;`. Updating the header documentation would keep callers' expectations aligned with this change.</violation>

<violation number="2" location="src/core/html/escape.cc:172">
P2: Appending a view of the destination string that contains a no-break space can invalidate `input` during this new path, causing undefined behavior on the next iteration. Copy the input before transforming it or explicitly enforce non-overlapping input and output.</violation>

<violation number="3" location="src/core/html/escape.cc:214">
P3: NBSP handling is now repeated across all three escaping implementations, increasing the risk of behavior drift. A shared predicate/helper or common escaping routine would keep the public overloads consistent.</violation>
</file>

<file name="src/core/oidc/oidc_registration.cc">

<violation number="1" location="src/core/oidc/oidc_registration.cc:104">
P2: Native registrations currently accept arbitrary non-HTTP(S) schemes as "custom" schemes, including `file`, `mailto`, and `urn`. Restrict this branch to private-use/custom application callback schemes rather than treating every non-HTTPS scheme as valid.</violation>
</file>

<file name="src/core/jsonld/jsonld_algorithms.h">

<violation number="1" location="src/core/jsonld/jsonld_algorithms.h:47">
P1: JSON-LD 1.0 compaction loses its processing mode after a null context reset: `active_context = ActiveContext{}` restores this field to false, so subsequent container selection follows the 1.1 path. Preserve `processing_1_0` across the reset, just as `compact_to_relative` is preserved.</violation>
</file>

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread src/core/yaml/parser.h
Comment thread src/core/oidc/oidc_registration.cc Outdated
Comment thread src/core/oidc/oidc_discovery.cc Outdated
Comment thread src/core/yaml/lexer.h Outdated
// Whether the document is processed under the JSON-LD 1.0 processing mode,
// which the compaction container selection consults without access to the
// expansion state.
bool processing_1_0{false};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: JSON-LD 1.0 compaction loses its processing mode after a null context reset: active_context = ActiveContext{} restores this field to false, so subsequent container selection follows the 1.1 path. Preserve processing_1_0 across the reset, just as compact_to_relative is preserved.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/jsonld/jsonld_algorithms.h, line 47:

<comment>JSON-LD 1.0 compaction loses its processing mode after a null context reset: `active_context = ActiveContext{}` restores this field to false, so subsequent container selection follows the 1.1 path. Preserve `processing_1_0` across the reset, just as `compact_to_relative` is preserved.</comment>

<file context>
@@ -41,6 +41,10 @@ struct ActiveContext {
+  // Whether the document is processed under the JSON-LD 1.0 processing mode,
+  // which the compaction container selection consults without access to the
+  // expansion state.
+  bool processing_1_0{false};
 };
 
</file context>

Comment thread src/core/yaml/lexer.h Outdated
Comment thread src/core/html/escape.cc
if (static_cast<unsigned char>(input[position]) == 0xC2 &&
position + 1 < input.size() &&
static_cast<unsigned char>(input[position + 1]) == 0xA0) {
output += "&nbsp;";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Appending a view of the destination string that contains a no-break space can invalidate input during this new path, causing undefined behavior on the next iteration. Copy the input before transforming it or explicitly enforce non-overlapping input and output.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/html/escape.cc, line 172:

<comment>Appending a view of the destination string that contains a no-break space can invalidate `input` during this new path, causing undefined behavior on the next iteration. Copy the input before transforming it or explicitly enforce non-overlapping input and output.</comment>

<file context>
@@ -119,8 +161,20 @@ auto html_escape_append(std::string &output, const std::string_view input)
+    if (static_cast<unsigned char>(input[position]) == 0xC2 &&
+        position + 1 < input.size() &&
+        static_cast<unsigned char>(input[position + 1]) == 0xA0) {
+      output += "&nbsp;";
+      position += 1;
+      continue;
</file context>

Comment thread src/core/oidc/oidc_authentication.cc
Comment thread src/core/html/escape.cc
if (static_cast<unsigned char>(input[position]) == 0xC2 &&
position + 1 < input.size() &&
static_cast<unsigned char>(input[position + 1]) == 0xA0) {
output.append("&nbsp;");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: NBSP handling is now repeated across all three escaping implementations, increasing the risk of behavior drift. A shared predicate/helper or common escaping routine would keep the public overloads consistent.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/html/escape.cc, line 214:

<comment>NBSP handling is now repeated across all three escaping implementations, increasing the risk of behavior drift. A shared predicate/helper or common escaping routine would keep the public overloads consistent.</comment>

<file context>
@@ -149,8 +203,20 @@ auto html_escape_append(HTMLBuffer &output, const std::string_view input)
+    if (static_cast<unsigned char>(input[position]) == 0xC2 &&
+        position + 1 < input.size() &&
+        static_cast<unsigned char>(input[position + 1]) == 0xA0) {
+      output.append("&nbsp;");
+      position += 1;
+      continue;
</file context>

Comment thread src/core/html/escape.cc
if (static_cast<unsigned char>(text[position]) == 0xC2 &&
position + 1 < text.size() &&
static_cast<unsigned char>(text[position + 1]) == 0xA0) {
required_size += 6; // &nbsp;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The public API documentation now understates the function's behavior: no-break spaces are also converted to &nbsp;. Updating the header documentation would keep callers' expectations aligned with this change.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/html/escape.cc, line 21:

<comment>The public API documentation now understates the function's behavior: no-break spaces are also converted to `&nbsp;`. Updating the header documentation would keep callers' expectations aligned with this change.</comment>

<file context>
@@ -9,8 +9,21 @@ auto html_escape(std::string &text) -> void {
+    if (static_cast<unsigned char>(text[position]) == 0xC2 &&
+        position + 1 < text.size() &&
+        static_cast<unsigned char>(text[position + 1]) == 0xA0) {
+      required_size += 6; // &nbsp;
+      position += 1;
+      continue;
</file context>

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (macos/llvm)

Details
Benchmark suite Current: 3ad9290 Previous: 8aff35e Ratio
Regex_Lower_S_Or_Upper_S_Asterisk 1.719081180535348 ns/iter 2.3698823091117096 ns/iter 0.73
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 1.7059855593263804 ns/iter 2.528901699763998 ns/iter 0.67
Regex_Period_Asterisk 1.7060167173911056 ns/iter 2.2585311973047197 ns/iter 0.76
Regex_Group_Period_Asterisk_Group 1.7206679774661113 ns/iter 2.239720265350053 ns/iter 0.77
Regex_Period_Plus 2.0406890971837353 ns/iter 3.208672620922083 ns/iter 0.64
Regex_Period 2.0438044440452146 ns/iter 3.5300753962230704 ns/iter 0.58
Regex_Caret_Period_Plus_Dollar 2.1059789163258853 ns/iter 2.6712181767915193 ns/iter 0.79
Regex_Caret_Group_Period_Plus_Group_Dollar 2.066686087662734 ns/iter 2.9796923420004906 ns/iter 0.69
Regex_Caret_Period_Asterisk_Dollar 1.9598527785828372 ns/iter 2.4444313241101865 ns/iter 0.80
Regex_Caret_Group_Period_Asterisk_Group_Dollar 1.975111134964998 ns/iter 2.246483926417279 ns/iter 0.88
Regex_Caret_X_Hyphen 6.169683337375346 ns/iter 7.216137019564622 ns/iter 0.85
Regex_Period_Md_Dollar 17.692674196242315 ns/iter 20.711185371663465 ns/iter 0.85
Regex_Caret_Slash_Period_Asterisk 4.444512383264182 ns/iter 5.499018750000459 ns/iter 0.81
Regex_Caret_Period_Range_Dollar 2.168296794169622 ns/iter 2.243984308304879 ns/iter 0.97
Regex_Nested_Backtrack 27.535807770491036 ns/iter 32.98788812877685 ns/iter 0.83
JSON_Array_Of_Objects_Unique 361.6069243653284 ns/iter 395.299270730361 ns/iter 0.91
JSON_Parse_1 6574.618891510307 ns/iter 7392.530871623064 ns/iter 0.89
JSON_Parse_Real 6680.211345395021 ns/iter 7232.9471239616905 ns/iter 0.92
JSON_Parse_Decimal 7614.20406117226 ns/iter 8445.326297683394 ns/iter 0.90
JSON_Parse_Schema_ISO_Language 3984832.622857409 ns/iter 5429420.807453007 ns/iter 0.73
JSON_Parse_Integer 4969.090208661498 ns/iter 6097.073297760452 ns/iter 0.81
JSON_Parse_String_NonSSO_Plain 8742.83356498009 ns/iter 8071.236347299985 ns/iter 1.08
JSON_Parse_String_SSO_Plain 2901.8142385624565 ns/iter 3121.261556733637 ns/iter 0.93
JSON_Parse_String_Escape_Heavy 21589.1374335158 ns/iter 22738.422414929148 ns/iter 0.95
JSON_Parse_Object_Short_Keys 8204.061923939214 ns/iter 9091.652588167492 ns/iter 0.90
JSON_Parse_Object_Scalar_Properties 4400.367892445292 ns/iter 4743.481769322068 ns/iter 0.93
JSON_Parse_Object_Array_Properties 7183.371244808111 ns/iter 7780.610548699173 ns/iter 0.92
JSON_Parse_Object_Object_Properties 7326.307418279817 ns/iter 8091.641428229654 ns/iter 0.91
JSON_Parse_Nested_Containers 63819.73416431601 ns/iter 66531.1579231957 ns/iter 0.96
JSON_From_String_Copy 23.165933286466046 ns/iter 26.513199935624993 ns/iter 0.87
JSON_From_String_Temporary 19.47657613209964 ns/iter 27.13319513890535 ns/iter 0.72
JSON_Number_To_Double 33.196249874702005 ns/iter 39.376359547922846 ns/iter 0.84
JSON_Object_At_Last_Key/8 4.5354218309480565 ns/iter 5.028394169999046 ns/iter 0.90
JSON_Object_At_Last_Key/32 14.359158173864051 ns/iter 14.075622591160704 ns/iter 1.02
JSON_Object_At_Last_Key/128 56.31917089463478 ns/iter 58.27382677395435 ns/iter 0.97
JSON_Object_At_Last_Key/512 195.40657898908108 ns/iter 198.35541408560528 ns/iter 0.99
JSON_Fast_Hash_Helm_Chart_Lock 59.20071127522416 ns/iter 61.20851353534515 ns/iter 0.97
JSON_Equality_Helm_Chart_Lock 149.1571966508636 ns/iter 145.08736280492943 ns/iter 1.03
JSON_Divisible_By_Decimal 176.70370161657075 ns/iter 177.19013097233764 ns/iter 1.00
JSON_String_Equal/10 7.1295878481228 ns/iter 7.068770267464803 ns/iter 1.01
JSON_String_Equal/100 6.809347249262713 ns/iter 6.9116898945268925 ns/iter 0.99
JSON_String_Equal_Small_By_Perfect_Hash/10 0.34035813600887105 ns/iter 0.37872343891774146 ns/iter 0.90
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 3.7134362880239102 ns/iter 3.6146115979649536 ns/iter 1.03
JSON_String_Fast_Hash/10 2.5456543773512705 ns/iter 2.658870291029563 ns/iter 0.96
JSON_String_Fast_Hash/100 2.0867625359500708 ns/iter 2.5935639999180786 ns/iter 0.80
JSON_String_Key_Hash/10 1.8778084107158655 ns/iter 1.9509578136588706 ns/iter 0.96
JSON_String_Key_Hash/100 2.4620720272891083 ns/iter 2.2947661702182494 ns/iter 1.07
JSON_Object_Defines_Miss_Same_Length 2.777248315593892 ns/iter 3.0586980084221795 ns/iter 0.91
JSON_Object_Defines_Miss_Too_Small 2.7795000249350457 ns/iter 3.07184171446613 ns/iter 0.90
JSON_Object_Defines_Miss_Too_Large 2.7779420652976974 ns/iter 2.921880923016916 ns/iter 0.95
Pointer_Object_Traverse 24.511220560977534 ns/iter 25.868220118501394 ns/iter 0.95
Pointer_Object_Try_Traverse 22.369949608284525 ns/iter 25.254908070399644 ns/iter 0.89
Pointer_Push_Back_Pointer_To_Weak_Pointer 182.1194981447705 ns/iter 170.34141004561818 ns/iter 1.07
Pointer_Walker_Schema_ISO_Language 2782663.19444464 ns/iter 3174616.0337553015 ns/iter 0.88
Pointer_Maybe_Tracked_Deeply_Nested/0 1288772.2419926738 ns/iter 1443632.323232371 ns/iter 0.89
Pointer_Maybe_Tracked_Deeply_Nested/1 1082194.0626912876 ns/iter 1136571.1931034639 ns/iter 0.95
Pointer_Position_Tracker_Get_Deeply_Nested 340.361703033485 ns/iter 376.45470664640254 ns/iter 0.90
JSONPath_Descendant_Filter_Nested 1404.2575078529194 ns/iter 1390.87080544984 ns/iter 1.01
URITemplateRouter_Create 24382.795390463853 ns/iter 24000.12955157951 ns/iter 1.02
URITemplateRouter_Match 167.95905068966974 ns/iter 177.8757965235765 ns/iter 0.94
URITemplateRouter_Match_BasePath 199.6965663635727 ns/iter 222.60610624919966 ns/iter 0.90
URITemplateRouterView_Restore 10345.737965432621 ns/iter 13223.855922416355 ns/iter 0.78
URITemplateRouterView_Match 139.18311261755977 ns/iter 174.40157649221337 ns/iter 0.80
URITemplateRouterView_Match_BasePath 157.5730910502408 ns/iter 213.31289383891095 ns/iter 0.74
URITemplateRouterView_Arguments 567.3060942526439 ns/iter 681.7760511747238 ns/iter 0.83
JSONL_Parse_Large 10543643.939392881 ns/iter 13250343.023255587 ns/iter 0.80
JSONL_Parse_Large_GZIP 15002517.30188657 ns/iter 12810429.018518081 ns/iter 1.17
JSONLD_Catalog_Annotation_List_Populate 1043392.2710147443 ns/iter 1069020.9548104831 ns/iter 0.98
JSONLD_Catalog_Materialize 4616603.315068074 ns/iter 6180187.090000118 ns/iter 0.75
HTML_Build_Table_100000 43701076.38889446 ns/iter 41850108.99999935 ns/iter 1.04
HTML_Render_Table_100000 2233463.315614459 ns/iter 1829214.8760333012 ns/iter 1.22
GZIP_Compress_ISO_Language_Set_3_Locations 26688051.269231364 ns/iter 27067671.461535472 ns/iter 0.99
GZIP_Decompress_ISO_Language_Set_3_Locations 3377273.149759047 ns/iter 3616733.879397173 ns/iter 0.93
GZIP_Compress_ISO_Language_Set_3_Schema 1532774.817391051 ns/iter 1720213.7738928236 ns/iter 0.89
GZIP_Decompress_ISO_Language_Set_3_Schema 268197.21447826637 ns/iter 302293.51976936153 ns/iter 0.89
JOSE_VerifySignature_RS256 22556.040309681655 ns/iter 22924.14088105926 ns/iter 0.98
JOSE_VerifySignature_ES512 1120177.6356339664 ns/iter 1294238.719269123 ns/iter 0.87

This comment was automatically generated by workflow using github-action-benchmark.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (linux/gcc)

Details
Benchmark suite Current: 3ad9290 Previous: 8aff35e Ratio
JOSE_VerifySignature_RS256 18992.464667033284 ns/iter 25069.564601268135 ns/iter 0.76
JOSE_VerifySignature_ES512 503120.3019999566 ns/iter 642649.1431192592 ns/iter 0.78
GZIP_Compress_ISO_Language_Set_3_Locations 30135128.956519864 ns/iter 39468433.50000033 ns/iter 0.76
GZIP_Decompress_ISO_Language_Set_3_Locations 2734870.587548609 ns/iter 4060399.040462329 ns/iter 0.67
GZIP_Compress_ISO_Language_Set_3_Schema 1737357.3995037167 ns/iter 2282482.431372557 ns/iter 0.76
GZIP_Decompress_ISO_Language_Set_3_Schema 195984.48365465994 ns/iter 280657.8539562326 ns/iter 0.70
HTML_Build_Table_100000 55702861.41666732 ns/iter 72975327.30000284 ns/iter 0.76
HTML_Render_Table_100000 1834966.4540683986 ns/iter 2042849.6787878955 ns/iter 0.90
JSONLD_Catalog_Annotation_List_Populate 1049007.3589364914 ns/iter 1316723.1581920667 ns/iter 0.80
JSONLD_Catalog_Materialize 5472567.367187154 ns/iter 7196125.584157764 ns/iter 0.76
JSONL_Parse_Large 10082833.000000313 ns/iter 13310204.12962929 ns/iter 0.76
JSONL_Parse_Large_GZIP 11215593.253968874 ns/iter 14455297.270833021 ns/iter 0.78
URITemplateRouter_Create 22099.55706813016 ns/iter 29997.082466754513 ns/iter 0.74
URITemplateRouter_Match 109.78129648570896 ns/iter 158.65871038566476 ns/iter 0.69
URITemplateRouter_Match_BasePath 133.98158269284585 ns/iter 187.80842460386404 ns/iter 0.71
URITemplateRouterView_Restore 7711.673087039951 ns/iter 9881.445096211175 ns/iter 0.78
URITemplateRouterView_Match 93.59165383260198 ns/iter 126.5957117366148 ns/iter 0.74
URITemplateRouterView_Match_BasePath 105.39007785405006 ns/iter 143.30862377491562 ns/iter 0.74
URITemplateRouterView_Arguments 364.98415626013303 ns/iter 470.3504254441957 ns/iter 0.78
JSONPath_Descendant_Filter_Nested 1376.6789452531193 ns/iter 1815.1415086119673 ns/iter 0.76
Pointer_Object_Traverse 25.860827408992986 ns/iter 32.29693372097696 ns/iter 0.80
Pointer_Object_Try_Traverse 20.186716805492743 ns/iter 31.733033350842387 ns/iter 0.64
Pointer_Push_Back_Pointer_To_Weak_Pointer 120.27413842015753 ns/iter 166.4939625835817 ns/iter 0.72
Pointer_Walker_Schema_ISO_Language 2286809.726384129 ns/iter 2930403.2541664545 ns/iter 0.78
Pointer_Maybe_Tracked_Deeply_Nested/0 1480651.7605934287 ns/iter 1886989.3675677355 ns/iter 0.78
Pointer_Maybe_Tracked_Deeply_Nested/1 1271879.9909256161 ns/iter 1641113.1705606251 ns/iter 0.78
Pointer_Position_Tracker_Get_Deeply_Nested 381.82290474429357 ns/iter 441.02146469627905 ns/iter 0.87
JSON_Array_Of_Objects_Unique 314.75971947720933 ns/iter 412.51351171027187 ns/iter 0.76
JSON_Parse_1 7568.2896410255225 ns/iter 9724.482873190254 ns/iter 0.78
JSON_Parse_Real 5915.423552061447 ns/iter 7696.733541672834 ns/iter 0.77
JSON_Parse_Decimal 8721.906831447746 ns/iter 11109.53324974576 ns/iter 0.79
JSON_Parse_Schema_ISO_Language 5331930.099237244 ns/iter 6721535.660194074 ns/iter 0.79
JSON_Parse_Integer 4509.783234983843 ns/iter 5667.766000226764 ns/iter 0.80
JSON_Parse_String_NonSSO_Plain 9690.766143930334 ns/iter 12328.032791791957 ns/iter 0.79
JSON_Parse_String_SSO_Plain 4079.6432827060858 ns/iter 4930.949775772731 ns/iter 0.83
JSON_Parse_String_Escape_Heavy 19358.041608992953 ns/iter 24279.012321321356 ns/iter 0.80
JSON_Parse_Object_Short_Keys 11195.960156812473 ns/iter 14340.233607732118 ns/iter 0.78
JSON_Parse_Object_Scalar_Properties 5709.176658830172 ns/iter 7253.425766985966 ns/iter 0.79
JSON_Parse_Object_Array_Properties 9978.766220068119 ns/iter 12546.590526105112 ns/iter 0.80
JSON_Parse_Object_Object_Properties 9458.90687537939 ns/iter 11933.3104024267 ns/iter 0.79
JSON_Parse_Nested_Containers 79166.26325369564 ns/iter 100034.98609917641 ns/iter 0.79
JSON_From_String_Copy 15.001578683113523 ns/iter 20.054636389009662 ns/iter 0.75
JSON_From_String_Temporary 12.413062357173603 ns/iter 16.715363559225505 ns/iter 0.74
JSON_Number_To_Double 15.279390617166523 ns/iter 19.70230135941304 ns/iter 0.78
JSON_Object_At_Last_Key/8 5.184611349999386 ns/iter 4.185956589748728 ns/iter 1.24
JSON_Object_At_Last_Key/32 18.41290387778772 ns/iter 13.391415391038814 ns/iter 1.37
JSON_Object_At_Last_Key/128 70.97868898964411 ns/iter 47.393196152990384 ns/iter 1.50
JSON_Object_At_Last_Key/512 293.5693201711161 ns/iter 287.46862883232706 ns/iter 1.02
JSON_Fast_Hash_Helm_Chart_Lock 55.282784468570995 ns/iter 72.47237065600599 ns/iter 0.76
JSON_Equality_Helm_Chart_Lock 118.28571409242983 ns/iter 177.70004210910392 ns/iter 0.67
JSON_Divisible_By_Decimal 192.25804872668786 ns/iter 246.90113049428984 ns/iter 0.78
JSON_String_Equal/10 4.124648173284786 ns/iter 5.720297458789268 ns/iter 0.72
JSON_String_Equal/100 4.942892820042796 ns/iter 6.416279244192599 ns/iter 0.77
JSON_String_Equal_Small_By_Perfect_Hash/10 0.5543808329020408 ns/iter 0.7103583429277825 ns/iter 0.78
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 17.050138696229304 ns/iter 22.04156442230875 ns/iter 0.77
JSON_String_Fast_Hash/10 1.9312548102748466 ns/iter 2.4637169574249658 ns/iter 0.78
JSON_String_Fast_Hash/100 1.9103061552753768 ns/iter 2.4640504481255214 ns/iter 0.78
JSON_String_Key_Hash/10 0.8420534733131906 ns/iter 1.0878227553238102 ns/iter 0.77
JSON_String_Key_Hash/100 11.448475320209733 ns/iter 14.75379905284031 ns/iter 0.78
JSON_Object_Defines_Miss_Same_Length 2.4549751247191485 ns/iter 3.1761807171318055 ns/iter 0.77
JSON_Object_Defines_Miss_Too_Small 2.7281151924647324 ns/iter 3.5200330593710825 ns/iter 0.78
JSON_Object_Defines_Miss_Too_Large 2.4600806618642537 ns/iter 3.1681158038446062 ns/iter 0.78
Regex_Lower_S_Or_Upper_S_Asterisk 0.5453706946357637 ns/iter 1.1128221528334892 ns/iter 0.49
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 0.5459070537685792 ns/iter 0.7038480482984898 ns/iter 0.78
Regex_Period_Asterisk 0.545780731617908 ns/iter 1.0549663743636828 ns/iter 0.52
Regex_Group_Period_Asterisk_Group 0.5456842135357037 ns/iter 0.7197374448373671 ns/iter 0.76
Regex_Period_Plus 0.5455142152410667 ns/iter 1.0559960479344528 ns/iter 0.52
Regex_Period 0.545834181619497 ns/iter 0.7038491967551008 ns/iter 0.78
Regex_Caret_Period_Plus_Dollar 0.5455959523220777 ns/iter 1.0554031780741364 ns/iter 0.52
Regex_Caret_Group_Period_Plus_Group_Dollar 0.5458569823072325 ns/iter 0.7032704615673933 ns/iter 0.78
Regex_Caret_Period_Asterisk_Dollar 0.552877898506178 ns/iter 1.06167764203011 ns/iter 0.52
Regex_Caret_Group_Period_Asterisk_Group_Dollar 0.5455544194718177 ns/iter 0.7046031582038512 ns/iter 0.77
Regex_Caret_X_Hyphen 2.9988936686648517 ns/iter 4.2219695017068215 ns/iter 0.71
Regex_Period_Md_Dollar 25.50726255011042 ns/iter 33.03046905353544 ns/iter 0.77
Regex_Caret_Slash_Period_Asterisk 2.9985683259554103 ns/iter 4.570132866368959 ns/iter 0.66
Regex_Caret_Period_Range_Dollar 1.091532187949537 ns/iter 1.4277267576653012 ns/iter 0.76
Regex_Nested_Backtrack 31.660077707438163 ns/iter 40.37959680745323 ns/iter 0.78

This comment was automatically generated by workflow using github-action-benchmark.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (linux/llvm)

Details
Benchmark suite Current: 3ad9290 Previous: 8aff35e Ratio
Regex_Lower_S_Or_Upper_S_Asterisk 2.47355038965745 ns/iter 2.4703299147704603 ns/iter 1.00
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 2.469324062248287 ns/iter 2.4621259318785578 ns/iter 1.00
Regex_Period_Asterisk 2.46288771293926 ns/iter 2.462440915697947 ns/iter 1.00
Regex_Group_Period_Asterisk_Group 2.467089758503555 ns/iter 2.4614979594241206 ns/iter 1.00
Regex_Period_Plus 3.5180355638927567 ns/iter 3.5166295745016036 ns/iter 1.00
Regex_Period 3.8670738578332697 ns/iter 3.86840881977122 ns/iter 1.00
Regex_Caret_Period_Plus_Dollar 3.8660488048636044 ns/iter 3.86759532125379 ns/iter 1.00
Regex_Caret_Group_Period_Plus_Group_Dollar 3.516230912484154 ns/iter 3.5164528847413616 ns/iter 1.00
Regex_Caret_Period_Asterisk_Dollar 2.46038362558277 ns/iter 2.462227624877124 ns/iter 1.00
Regex_Caret_Group_Period_Asterisk_Group_Dollar 2.8136146964116837 ns/iter 2.8137534792714898 ns/iter 1.00
Regex_Caret_X_Hyphen 7.035362914237749 ns/iter 5.978877482465201 ns/iter 1.18
Regex_Period_Md_Dollar 26.20463542897463 ns/iter 26.14901645261172 ns/iter 1.00
Regex_Caret_Slash_Period_Asterisk 6.188074524603644 ns/iter 7.3112960656822565 ns/iter 0.85
Regex_Caret_Period_Range_Dollar 4.5787665938882895 ns/iter 3.166593752871534 ns/iter 1.45
Regex_Nested_Backtrack 39.25232357226578 ns/iter 38.7580990761577 ns/iter 1.01
JSON_Array_Of_Objects_Unique 435.0995604491445 ns/iter 434.3484667835172 ns/iter 1.00
JSON_Parse_1 4761.675486133426 ns/iter 4702.925277617711 ns/iter 1.01
JSON_Parse_Real 5208.1581015702795 ns/iter 5153.039496927263 ns/iter 1.01
JSON_Parse_Decimal 7444.709888128119 ns/iter 7570.081978167186 ns/iter 0.98
JSON_Parse_Schema_ISO_Language 3492165.422110716 ns/iter 3553691.187816933 ns/iter 0.98
JSON_Parse_Integer 3868.1542964436667 ns/iter 3861.890435578016 ns/iter 1.00
JSON_Parse_String_NonSSO_Plain 5064.3313571527815 ns/iter 5076.944868912842 ns/iter 1.00
JSON_Parse_String_SSO_Plain 2778.593418179002 ns/iter 2829.4731135010143 ns/iter 0.98
JSON_Parse_String_Escape_Heavy 14637.329818331717 ns/iter 14470.852625472911 ns/iter 1.01
JSON_Parse_Object_Short_Keys 7837.735106287658 ns/iter 7809.236834206397 ns/iter 1.00
JSON_Parse_Object_Scalar_Properties 3972.7630715800483 ns/iter 4054.555407650079 ns/iter 0.98
JSON_Parse_Object_Array_Properties 5538.520986855489 ns/iter 5459.29448340952 ns/iter 1.01
JSON_Parse_Object_Object_Properties 5491.575881299469 ns/iter 5463.316306790045 ns/iter 1.01
JSON_Parse_Nested_Containers 44726.38675200142 ns/iter 44848.90619424163 ns/iter 1.00
JSON_From_String_Copy 20.76594106457682 ns/iter 20.631065422220438 ns/iter 1.01
JSON_From_String_Temporary 17.979021638198798 ns/iter 17.597716354823362 ns/iter 1.02
JSON_Number_To_Double 22.868207286069183 ns/iter 22.888150822069115 ns/iter 1.00
JSON_Object_At_Last_Key/8 4.020006117387577 ns/iter 4.13075773931292 ns/iter 0.97
JSON_Object_At_Last_Key/32 13.068107028536753 ns/iter 13.064892997318918 ns/iter 1.00
JSON_Object_At_Last_Key/128 47.19202355442594 ns/iter 46.807234943984355 ns/iter 1.01
JSON_Object_At_Last_Key/512 371.1569303962857 ns/iter 372.53229788918975 ns/iter 1.00
JSON_Fast_Hash_Helm_Chart_Lock 73.25972145423854 ns/iter 73.1300237353371 ns/iter 1.00
JSON_Equality_Helm_Chart_Lock 157.12306776396957 ns/iter 161.20835687564755 ns/iter 0.97
JSON_Divisible_By_Decimal 254.7987812696049 ns/iter 253.1731309442262 ns/iter 1.01
JSON_String_Equal/10 5.6283979305458 ns/iter 5.6278592590582015 ns/iter 1.00
JSON_String_Equal/100 6.333579671948568 ns/iter 6.345154992102968 ns/iter 1.00
JSON_String_Equal_Small_By_Perfect_Hash/10 1.0558825896223143 ns/iter 1.054946386668885 ns/iter 1.00
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 12.470166767896778 ns/iter 12.356401447474243 ns/iter 1.01
JSON_String_Fast_Hash/10 2.9139897998543116 ns/iter 2.814820220866364 ns/iter 1.04
JSON_String_Fast_Hash/100 2.815610663297936 ns/iter 2.815937767048371 ns/iter 1.00
JSON_String_Key_Hash/10 2.4622176646176186 ns/iter 2.4619587124293676 ns/iter 1.00
JSON_String_Key_Hash/100 7.755724357459616 ns/iter 8.145002081680865 ns/iter 0.95
JSON_Object_Defines_Miss_Same_Length 3.2076641829152504 ns/iter 3.2335519938655253 ns/iter 0.99
JSON_Object_Defines_Miss_Too_Small 4.260060555010481 ns/iter 4.234070931503273 ns/iter 1.01
JSON_Object_Defines_Miss_Too_Large 2.991869364254188 ns/iter 2.9760346973442404 ns/iter 1.01
Pointer_Object_Traverse 30.685523635317516 ns/iter 31.01031359101829 ns/iter 0.99
Pointer_Object_Try_Traverse 33.20294414831815 ns/iter 32.933218358240836 ns/iter 1.01
Pointer_Push_Back_Pointer_To_Weak_Pointer 174.53302409106328 ns/iter 196.03077776889342 ns/iter 0.89
Pointer_Walker_Schema_ISO_Language 2892138.749004346 ns/iter 2779797.9080000916 ns/iter 1.04
Pointer_Maybe_Tracked_Deeply_Nested/0 1252259.5439856562 ns/iter 1275850.910746736 ns/iter 0.98
Pointer_Maybe_Tracked_Deeply_Nested/1 1570476.399103066 ns/iter 1575659.5078653519 ns/iter 1.00
Pointer_Position_Tracker_Get_Deeply_Nested 718.4913396142714 ns/iter 746.1954138982629 ns/iter 0.96
JSONPath_Descendant_Filter_Nested 1587.151388074869 ns/iter 1639.0879055236558 ns/iter 0.97
URITemplateRouter_Create 29957.212166298425 ns/iter 30330.72104767911 ns/iter 0.99
URITemplateRouter_Match 182.78997519805657 ns/iter 180.55685313223032 ns/iter 1.01
URITemplateRouter_Match_BasePath 217.7379602903209 ns/iter 212.13468041657043 ns/iter 1.03
URITemplateRouterView_Restore 9904.077645749496 ns/iter 10039.936854190015 ns/iter 0.99
URITemplateRouterView_Match 144.00713194779854 ns/iter 144.08808981901814 ns/iter 1.00
URITemplateRouterView_Match_BasePath 164.89326636229035 ns/iter 168.98129107473713 ns/iter 0.98
URITemplateRouterView_Arguments 450.491724899046 ns/iter 466.6138783948533 ns/iter 0.97
JSONL_Parse_Large 9088433.714285426 ns/iter 9145614 ns/iter 0.99
JSONL_Parse_Large_GZIP 10797285.984615603 ns/iter 10772486.123077076 ns/iter 1.00
JSONLD_Catalog_Annotation_List_Populate 1272276.4936014968 ns/iter 1279970.431444114 ns/iter 0.99
JSONLD_Catalog_Materialize 4315705.728394991 ns/iter 4257392.64634178 ns/iter 1.01
HTML_Build_Table_100000 74970681.80000497 ns/iter 70774062.89999999 ns/iter 1.06
HTML_Render_Table_100000 4762502.843537472 ns/iter 5217883.925372937 ns/iter 0.91
GZIP_Compress_ISO_Language_Set_3_Locations 35600007.600004345 ns/iter 35953941.57894971 ns/iter 0.99
GZIP_Decompress_ISO_Language_Set_3_Locations 4259031.036585201 ns/iter 4258345.567073198 ns/iter 1.00
GZIP_Compress_ISO_Language_Set_3_Schema 2138023.030395143 ns/iter 2138476.559632921 ns/iter 1.00
GZIP_Decompress_ISO_Language_Set_3_Schema 277250.355898648 ns/iter 276022.44435672736 ns/iter 1.00
JOSE_VerifySignature_RS256 63903.873837734085 ns/iter 64078.854018582264 ns/iter 1.00
JOSE_VerifySignature_ES512 2735878.183593776 ns/iter 2689560.6923075705 ns/iter 1.02

This comment was automatically generated by workflow using github-action-benchmark.

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 14 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="test/yaml/yaml_parse_test.cc">

<violation number="1" location="test/yaml/yaml_parse_test.cc:1202">
P3: The valid-case block added to raw_control_character_is_rejected exactly duplicates the utf8_multibyte_scalar_is_accepted test. Having the same test input and assertions in two locations creates maintenance debt — if the expected behavior changes, both must be updated. Consider removing the block here since the scenario is already covered by its own dedicated test.</violation>

<violation number="2" location="test/yaml/yaml_parse_test.cc:1278">
P3: The valid-case block added to duplicate_tag_directive_same_handle_is_rejected exactly duplicates the distinct_tag_directive_handles_are_accepted test. Two test functions now cover the identical scenario, which means future changes to the expected behavior require coordinated updates in both places. Consider removing this block since the positive case has its own dedicated test.</violation>
</file>

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

FAIL();
}

const std::string valid{"%TAG !e! tag:example.com,2000:app/\n"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The valid-case block added to duplicate_tag_directive_same_handle_is_rejected exactly duplicates the distinct_tag_directive_handles_are_accepted test. Two test functions now cover the identical scenario, which means future changes to the expected behavior require coordinated updates in both places. Consider removing this block since the positive case has its own dedicated test.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At test/yaml/yaml_parse_test.cc, line 1278:

<comment>The valid-case block added to duplicate_tag_directive_same_handle_is_rejected exactly duplicates the distinct_tag_directive_handles_are_accepted test. Two test functions now cover the identical scenario, which means future changes to the expected behavior require coordinated updates in both places. Consider removing this block since the positive case has its own dedicated test.</comment>

<file context>
@@ -1243,6 +1274,14 @@ TEST(duplicate_tag_directive_same_handle_is_rejected) {
     FAIL();
   }
+
+  const std::string valid{"%TAG !e! tag:example.com,2000:app/\n"
+                          "%TAG !f! tag:example.com,2000:other/\n"
+                          "--- value\n"};
</file context>

FAIL();
}

const std::string valid{"key: caf\xc3\xa9"};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: The valid-case block added to raw_control_character_is_rejected exactly duplicates the utf8_multibyte_scalar_is_accepted test. Having the same test input and assertions in two locations creates maintenance debt — if the expected behavior changes, both must be updated. Consider removing the block here since the scenario is already covered by its own dedicated test.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At test/yaml/yaml_parse_test.cc, line 1202:

<comment>The valid-case block added to raw_control_character_is_rejected exactly duplicates the utf8_multibyte_scalar_is_accepted test. Having the same test input and assertions in two locations creates maintenance debt — if the expected behavior changes, both must be updated. Consider removing the block here since the scenario is already covered by its own dedicated test.</comment>

<file context>
@@ -1184,6 +1198,13 @@ TEST(raw_control_character_is_rejected) {
     FAIL();
   }
+
+  const std::string valid{"key: caf\xc3\xa9"};
+  const auto result{sourcemeta::core::parse_yaml(valid)};
+  auto expected{sourcemeta::core::JSON::make_object()};
</file context>

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark (windows/msvc)

Details
Benchmark suite Current: 3ad9290 Previous: 8aff35e Ratio
Regex_Lower_S_Or_Upper_S_Asterisk 5.495625999999447 ns/iter 3.92989070726797 ns/iter 1.40
Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar 5.020284999998239 ns/iter 3.840212671714103 ns/iter 1.31
Regex_Period_Asterisk 5.099064285713796 ns/iter 3.8394996360006375 ns/iter 1.33
Regex_Group_Period_Asterisk_Group 5.0360088180875 ns/iter 3.8404447544644023 ns/iter 1.31
Regex_Period_Plus 5.088171428572049 ns/iter 3.568517248888624 ns/iter 1.43
Regex_Period 5.423163392856217 ns/iter 3.7227492790663774 ns/iter 1.46
Regex_Caret_Period_Plus_Dollar 5.09309900000062 ns/iter 3.5696744363866952 ns/iter 1.43
Regex_Caret_Group_Period_Plus_Group_Dollar 5.369726785713981 ns/iter 3.6135109988185365 ns/iter 1.49
Regex_Caret_Period_Asterisk_Dollar 5.322774000001118 ns/iter 3.8825254533617133 ns/iter 1.37
Regex_Caret_Group_Period_Asterisk_Group_Dollar 5.087932142856744 ns/iter 3.8359478502931355 ns/iter 1.33
Regex_Caret_X_Hyphen 8.505227678572425 ns/iter 6.2721089285712335 ns/iter 1.36
Regex_Period_Md_Dollar 45.411267898121885 ns/iter 43.170512499997926 ns/iter 1.05
Regex_Caret_Slash_Period_Asterisk 8.11452232142835 ns/iter 5.762247321429064 ns/iter 1.41
Regex_Caret_Period_Range_Dollar 6.064380000000255 ns/iter 4.1762798418853135 ns/iter 1.45
Regex_Nested_Backtrack 57.035610000002634 ns/iter 60.038940000004004 ns/iter 0.95
JSON_Array_Of_Objects_Unique 600.1591071428232 ns/iter 600.2284821429425 ns/iter 1.00
JSON_Parse_1 9118.760630530964 ns/iter 7408.26785714331 ns/iter 1.23
JSON_Parse_Real 16423.529845063662 ns/iter 13036.767857142553 ns/iter 1.26
JSON_Parse_Decimal 11861.681250000089 ns/iter 11800.056919642238 ns/iter 1.01
JSON_Parse_Schema_ISO_Language 7331061.11111081 ns/iter 6761746.666666113 ns/iter 1.08
JSON_Parse_Integer 6204.40625000031 ns/iter 4609.4750754238585 ns/iter 1.35
JSON_Parse_String_NonSSO_Plain 7817.6316964270345 ns/iter 6029.8582589294165 ns/iter 1.30
JSON_Parse_String_SSO_Plain 3672.78099218081 ns/iter 2846.9241308373594 ns/iter 1.29
JSON_Parse_String_Escape_Heavy 21732.276425488522 ns/iter 16514.130674980923 ns/iter 1.32
JSON_Parse_Object_Short_Keys 13436.091071428433 ns/iter 10246.810505310077 ns/iter 1.31
JSON_Parse_Object_Scalar_Properties 6901.271205355743 ns/iter 5280.89199999954 ns/iter 1.31
JSON_Parse_Object_Array_Properties 11536.321428569148 ns/iter 8909.550403792751 ns/iter 1.29
JSON_Parse_Object_Object_Properties 11981.575000001092 ns/iter 9068.382284007761 ns/iter 1.32
JSON_Parse_Nested_Containers 80112.23214283396 ns/iter 63809.56250000379 ns/iter 1.26
JSON_From_String_Copy 65.74119642857163 ns/iter 48.34665168517282 ns/iter 1.36
JSON_From_String_Temporary 60.2694107142757 ns/iter 62.71806250000265 ns/iter 0.96
JSON_Number_To_Double 122.36376785714194 ns/iter 102.96862499998838 ns/iter 1.19
JSON_Object_At_Last_Key/8 7.233608003422993 ns/iter 5.906833035714344 ns/iter 1.22
JSON_Object_At_Last_Key/32 23.246380320912706 ns/iter 19.329254636867255 ns/iter 1.20
JSON_Object_At_Last_Key/128 91.2827637820121 ns/iter 72.73309151785463 ns/iter 1.26
JSON_Object_At_Last_Key/512 424.11022028514327 ns/iter 333.4935521084025 ns/iter 1.27
JSON_Fast_Hash_Helm_Chart_Lock 104.27385937497037 ns/iter 97.93834384203653 ns/iter 1.06
JSON_Equality_Helm_Chart_Lock 238.2326428571397 ns/iter 157.76343749998034 ns/iter 1.51
JSON_Divisible_By_Decimal 303.58875183159506 ns/iter 300.12718971794277 ns/iter 1.01
JSON_String_Equal/10 11.268232812501113 ns/iter 7.688915178571319 ns/iter 1.47
JSON_String_Equal/100 11.844244642856795 ns/iter 8.791727639323529 ns/iter 1.35
JSON_String_Equal_Small_By_Perfect_Hash/10 2.6252048860493513 ns/iter 1.6455609609233872 ns/iter 1.60
JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10 14.277921364832215 ns/iter 11.235799503411194 ns/iter 1.27
JSON_String_Fast_Hash/10 6.669352678571272 ns/iter 4.936547999999448 ns/iter 1.35
JSON_String_Fast_Hash/100 6.667049107142426 ns/iter 4.9392120000004525 ns/iter 1.35
JSON_String_Key_Hash/10 5.373663000000306 ns/iter 3.839391957429856 ns/iter 1.40
JSON_String_Key_Hash/100 11.91564687499991 ns/iter 8.48251785714333 ns/iter 1.40
JSON_Object_Defines_Miss_Same_Length 3.791578125000226 ns/iter 2.9999379870535035 ns/iter 1.26
JSON_Object_Defines_Miss_Too_Small 4.140990409180042 ns/iter 3.248714147434561 ns/iter 1.27
JSON_Object_Defines_Miss_Too_Large 3.8374649931470275 ns/iter 2.987148187963525 ns/iter 1.28
Pointer_Object_Traverse 71.39824999999941 ns/iter 50.72182000000112 ns/iter 1.41
Pointer_Object_Try_Traverse 71.57416294642108 ns/iter 52.67662500000167 ns/iter 1.36
Pointer_Push_Back_Pointer_To_Weak_Pointer 182.5622305859436 ns/iter 126.92755683359128 ns/iter 1.44
Pointer_Walker_Schema_ISO_Language 10787846.666665548 ns/iter 9305410.714286413 ns/iter 1.16
Pointer_Maybe_Tracked_Deeply_Nested/0 2557029.718875939 ns/iter 1829236.609336682 ns/iter 1.40
Pointer_Maybe_Tracked_Deeply_Nested/1 3603717.9487184635 ns/iter 2853759.437751006 ns/iter 1.26
Pointer_Position_Tracker_Get_Deeply_Nested 520.2318750000196 ns/iter 408.1508107762097 ns/iter 1.27
JSONPath_Descendant_Filter_Nested 2446.596711387645 ns/iter 1953.7411314075487 ns/iter 1.25
URITemplateRouter_Create 41425.70367361079 ns/iter 30594.325459093572 ns/iter 1.35
URITemplateRouter_Match 239.38390185448168 ns/iter 166.0173637958058 ns/iter 1.44
URITemplateRouter_Match_BasePath 275.9261774966926 ns/iter 188.93203472604628 ns/iter 1.46
URITemplateRouterView_Restore 34860.17437773121 ns/iter 18907.098277663772 ns/iter 1.84
URITemplateRouterView_Match 180.62224647021006 ns/iter 133.6232150168281 ns/iter 1.35
URITemplateRouterView_Match_BasePath 204.91143750000163 ns/iter 152.16486607142954 ns/iter 1.35
URITemplateRouterView_Arguments 548.2154999999693 ns/iter 454.83814379331915 ns/iter 1.21
JSONL_Parse_Large 33218279.99999414 ns/iter 25386380.769230776 ns/iter 1.31
JSONL_Parse_Large_GZIP 33750700.00000354 ns/iter 25926069.23076783 ns/iter 1.30
JSONLD_Catalog_Annotation_List_Populate 2716878.7148593585 ns/iter 2081210.0000000554 ns/iter 1.31
JSONLD_Catalog_Materialize 7913458.888889282 ns/iter 6570806.666666662 ns/iter 1.20
HTML_Build_Table_100000 90317185.71428168 ns/iter 72129911.1111067 ns/iter 1.25
HTML_Render_Table_100000 7893204.464285271 ns/iter 6421672.321428063 ns/iter 1.23
GZIP_Compress_ISO_Language_Set_3_Locations 36994915.78947201 ns/iter 27974364.000001516 ns/iter 1.32
GZIP_Decompress_ISO_Language_Set_3_Locations 9701983.999999963 ns/iter 7178040.178571011 ns/iter 1.35
GZIP_Compress_ISO_Language_Set_3_Schema 2151502.8125001835 ns/iter 1719331.2039312476 ns/iter 1.25
GZIP_Decompress_ISO_Language_Set_3_Schema 606975.4464285942 ns/iter 412890.8879860698 ns/iter 1.47
JOSE_VerifySignature_RS256 21190.311067268678 ns/iter 18393.951731710476 ns/iter 1.15
JOSE_VerifySignature_ES512 1530209.8214284854 ns/iter 1175425.0000001725 ns/iter 1.30

This comment was automatically generated by workflow using github-action-benchmark.

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 15 files (changes from recent commits).

Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic

Comment thread src/core/html/include/sourcemeta/core/html_escape.h
jviotti added 2 commits July 30, 2026 11:14
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 issues found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/yaml/parser.h">

<violation number="1" location="src/core/yaml/parser.h:2092">
P2: Empty explicit documents are not recorded as ended, so a valid directive before the next document is rejected. Recording `document_ended_` when the `DocumentStart` path consumes `DocumentEnd` would keep this boundary consistent with the other two end-marker paths.</violation>
</file>

<file name="src/core/oidc/oidc_authentication.cc">

<violation number="1" location="src/core/oidc/oidc_authentication.cc:83">
P3: Parsing a scope borrowed from the query permanently grows `storage` by the full original scope even though only the compacted result is used, causing avoidable arena growth when the storage is reused. Shrinking the appended tail back to `offset + length` after compaction would retain only the result.</violation>
</file>

Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic

Comment thread src/core/yaml/parser.h
// Whether the document parsed by the most recent call ended with an explicit
// document end marker, so a subsequent stream validation knows a document
// boundary was already crossed
bool document_ended_{false};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Empty explicit documents are not recorded as ended, so a valid directive before the next document is rejected. Recording document_ended_ when the DocumentStart path consumes DocumentEnd would keep this boundary consistent with the other two end-marker paths.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/yaml/parser.h, line 2092:

<comment>Empty explicit documents are not recorded as ended, so a valid directive before the next document is rejected. Recording `document_ended_` when the `DocumentStart` path consumes `DocumentEnd` would keep this boundary consistent with the other two end-marker paths.</comment>

<file context>
@@ -2074,6 +2086,10 @@ class Parser {
+  // Whether the document parsed by the most recent call ended with an explicit
+  // document end marker, so a subsequent stream validation knows a document
+  // boundary was already crossed
+  bool document_ended_{false};
 };
 
</file context>

}

offset = storage.size();
storage.resize(storage.size() + scope.size());

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P3: Parsing a scope borrowed from the query permanently grows storage by the full original scope even though only the compacted result is used, causing avoidable arena growth when the storage is reused. Shrinking the appended tail back to offset + length after compaction would retain only the result.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/core/oidc/oidc_authentication.cc, line 83:

<comment>Parsing a scope borrowed from the query permanently grows `storage` by the full original scope even though only the compacted result is used, causing avoidable arena growth when the storage is reused. Shrinking the appended tail back to `offset + length` after compaction would retain only the result.</comment>

<file context>
@@ -57,21 +57,32 @@ auto offline_access_is_valid(const std::string_view scope,
+    }
+
+    offset = storage.size();
+    storage.resize(storage.size() + scope.size());
   }
 
</file context>

jviotti added 2 commits July 30, 2026 11:34
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
@jviotti

jviotti commented Jul 30, 2026

Copy link
Copy Markdown
Member Author

augment review

@augmentcode augmentcode Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

@jviotti
jviotti merged commit 2b7e4d5 into main Jul 30, 2026
12 checks passed
@jviotti
jviotti deleted the harden-a branch July 30, 2026 15:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant