fix: Security Hardening

[ravisoundar]

Description

Fixes the security vulnerability issues reported through the autonomous fuzzing campaign.

ARB 6385019: [PSIRT-Fuzz] Unauthenticated POST /v1/generate with provider=test + engine=slurm and a modelFileName whose…
ARB 6385048: [PSIRT-Fuzz] An unauthenticated POST to the topograph API server (/v1/generate or /v1/lookup) with…
ARB 6385121: [PSIRT-Fuzz] Unauthenticated POST /v1/generate (provider=test, engine=slurm, plugin=topology/block) with a…
ARB 6385310: [PSIRT-Fuzz] The InfiniBand provider parses ibnetdiscover/pdsh command output with an unchecked…
ARB 6385450: [PSIRT-Fuzz] parseNetq in the NetQ provider dereferences nodeMap[up] without a nil check (netq.go:207) when…
ARB 6385488: [PSIRT-Fuzz] Unauthenticated POST /v1/generate selecting the production-registered "test" provider passes…
ARB 6385529: [PSIRT-Fuzz] topograph translate tree walkers have no visited set; ID=child-key self-edge -> infinite-loop DoS
ARB 6385613: [PSIRT-Fuzz] Unauthenticated POST /v1/generate writes a file to an attacker-chosen arbitrary path: the…
ARB 6399661: [PSIRT-Fuzz] topograph gcp-sim provider: index-out-of-range panic on switchless model node (NetLayers OOB)

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.
• All commits are signed off per DCO (git commit -s).

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ravisoundar]

/ok-to-test cbcab89

[greptile-apps]

Greptile Summary

This PR hardens request processing and topology generation against fuzz-discovered crashes, denial-of-service inputs, and unsafe filesystem access.

• Restricts topology output paths and test-provider model filenames.
• Bounds cluster-set expansion and block topology allocation.
• Adds malformed-data, nil-reference, cycle, and panic handling across providers, translation, and asynchronous request processing.
• Adds regression and integration coverage for the hardened paths.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/cluset/cluset.go	Adds bounded range expansion and correctly fixes both previously reported integer-boundary denial-of-service paths.
internal/files/utils.go	Adds lexical output-path validation used by server request validation.
pkg/server/http_server.go	Enforces configured topology output boundaries and resolves bare output filenames into the configured directory.
pkg/server/trailing_delay_queue.go	Converts handler panics in asynchronous processing into controlled internal-server-error results.
pkg/translate/topology.go	Rejects nil children and direct self-edges while constructing translation state.
pkg/translate/tree.go	Adds visited tracking to prevent repeated traversal of cyclic topology vertices.
pkg/translate/yaml.go	Applies bounded node expansion to tree and block topology generation and propagates validation errors.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Server
    participant Queue
    participant Provider
    participant Translator
    participant Filesystem
    Client->>Server: POST /v1/generate
    Server->>Server: Validate request and output path
    Server->>Queue: Submit validated request
    Queue->>Provider: Generate topology data
    Provider-->>Queue: Bounded, validated graph
    Queue->>Translator: Render topology
    Translator->>Translator: Bound expansion and skip cycles
    Translator->>Filesystem: Write only to allowed destination
    Queue-->>Client: Result or controlled HTTP error

Loading

_{Reviews (4): Last reviewed commit: "incorporate greptile review comments" | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 92.00000% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.05%. Comparing base (8468abe) to head (a803b60).
⚠️ Report is 41 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/cluset/cluset.go	92.59%	1 Missing and 1 partial ⚠️
pkg/engines/slurm/slurm.go	66.66%	1 Missing and 1 partial ⚠️
pkg/translate/tree.go	50.00%	1 Missing and 1 partial ⚠️
pkg/translate/yaml.go	86.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #448      +/-   ##
==========================================
+ Coverage   72.15%   76.05%   +3.89%     
==========================================
  Files          89       95       +6     
  Lines        5689     6745    +1056     
==========================================
+ Hits         4105     5130    +1025     
+ Misses       1382     1346      -36     
- Partials      202      269      +67     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ravisoundar]

/ok-to-test a803b60

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pull-request-448.docs.buildwithfern.com/topograph