[dmt] Harden chart loading against symlink loops and oversized files

README.md

@@ -237,6 +237,14 @@ linters-settings:
 
   documentation:
     impact: error
+    exclude-rules:
+      # Silence the "file too large" warning for generated/bundled docs
+      # (size check only; content checks are unaffected)
+      file-size:
+        files:
+          - docs/generated-reference.md
+        directories:
+          - docs/generated/
 
   templates:
     impact: error

internal/fsutils/fsutils.go

@@ -17,6 +17,7 @@ limitations under the License.
 package fsutils
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -31,6 +32,40 @@ import (
 // evalSymlinkCache is a cache for evaluated symlinks to avoid multiple evaluations
 var evalSymlinkCache sync.Map
 
+// MaxLintableFileSize bounds how large a file dmt will read into memory while
+// linting. Files above it are generated data blobs (bundled Grafana dashboards,
+// rendered openapi, CRD bundles), not hand-written sources; reading a
+// multi-gigabyte file just to scan it would exhaust memory and flood the log.
+const MaxLintableFileSize = 10 << 20 // 10 MiB
+
+// ErrFileTooLarge is returned by ReadFile when a file exceeds MaxLintableFileSize.
+var ErrFileTooLarge = errors.New("file too large to lint")
+
+// ReadFile reads the named file like os.ReadFile but refuses files larger than
+// MaxLintableFileSize, returning ErrFileTooLarge instead of loading a huge file
+// into memory. Callers that scan discovered files should treat ErrFileTooLarge
+// as "skip this file" rather than a hard failure.
+func ReadFile(path string) ([]byte, error) {
+	info, err := os.Stat(path)
+	if err != nil {
+		return nil, err
+	}
+
+	if info.Size() > MaxLintableFileSize {
+		return nil, fmt.Errorf("%w: %s (%d bytes)", ErrFileTooLarge, path, info.Size())
+	}
+
+	return os.ReadFile(path)
+}
+
+// IsFileTooLarge reports whether err was produced by ReadFile refusing an
+// oversized file. Linters that scan discovered files use it to skip such files
+// rather than failing. It exists so callers need not import the standard errors
+// package, which many of them alias to dmt's own errors package.
+func IsFileTooLarge(err error) bool {
+	return errors.Is(err, ErrFileTooLarge)
+}
+
 // IsDir checks if the given path is a directory
 func IsDir(path string) bool {
 	fi, err := os.Stat(path)

internal/fsutils/readfile_test.go

@@ -0,0 +1,73 @@
+/*
+Copyright 2025 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fsutils
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestReadFile_ReadsNormalFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "ok.txt")
+
+	want := []byte("hello")
+	if err := os.WriteFile(path, want, 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	got, err := ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile: %v", err)
+	}
+
+	if string(got) != string(want) {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}
+
+func TestReadFile_RejectsOversizedFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "huge.bin")
+
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+
+	if err := f.Truncate(MaxLintableFileSize + 1); err != nil {
+		t.Fatalf("truncate: %v", err)
+	}
+
+	if err := f.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	got, err := ReadFile(path)
+	if err == nil {
+		t.Fatalf("expected an error for an oversized file, got %d bytes", len(got))
+	}
+
+	if !IsFileTooLarge(err) {
+		t.Errorf("expected IsFileTooLarge to report true for %v", err)
+	}
+
+	if got != nil {
+		t.Errorf("expected no data for an oversized file, got %d bytes", len(got))
+	}
+}