fn capped_component_array<'a>(
arr: Option<&'a [Value]>,
key: &str,
warnings: &mut WarningSink,
) -> &'a [Value]Expand description
Bounds a manifest component array’s length BEFORE any per-entry
processing happens, so one cap protects every warning a per-entry
loop can produce (non-string entries, unsafe paths, not-found
lookups, malformed content, …) at once — codex P1, PR #2379 round
7: round 6 bounded only the “duplicate reference” warning
specifically; a manifest filled with non-string junk values hit an
entirely different (still unbounded) warning path for the same
amplification effect. Reuses MAX_ENTRY_COUNT — a manifest
component array legitimately needs the same “more entries than any
real bundle uses” ceiling a zip archive’s entry count does.