[Stability: Configuration] Shared certificate-renewal thresholds can overflow downstream calculations #121

Severity: Medium
Classification: Confirmed validation gap; invalid shared configuration is required.

Locations

/home/runner/work/BackFiller/BackFiller/src/BackFiller/NntpDb/NntpSharedConfigurationReader.cs:112–115
/home/runner/work/BackFiller/BackFiller/src/BackFiller/Acme/AcmeComponentFactory.cs:80–89
/home/runner/work/BackFiller/BackFiller/src/BackFiller/Acme/CertificateValidator.cs:60–71
Code

C#
if (row.AcmeRenewalThresholdDays is < 1 or > int.MaxValue)
{
throw new InvalidOperationException(
"nntpsharedconfig.acmerenewalthresholddays must be a positive 32-bit integer.");
}
Downstream:

C#
var renewalThreshold = TimeSpan.FromDays(options.AcmeRenewalThresholdDays);
C#
var due = current >= material.NotAfter - renewalThreshold;
Description

The shared database reader accepts positive values up to int.MaxValue, but downstream operations cannot safely handle that entire range:

Very large values overflow TimeSpan.FromDays.
Smaller, representable durations can underflow the certificate’s DateTimeOffset during subtraction.
Operationally excessive thresholds can make newly issued certificates immediately due for renewal, causing repeated issuance attempts.
The normal ACME validator contains a 1–90-day check, but the BackFiller host deliberately disables validation of these database-owned fields. The database reader therefore needs to establish the usable contract itself.

Recommendation

Define and enforce a supported renewal-threshold range at the shared-configuration boundary, before publishing the snapshot. Do not assume the separate options validator protects this path.

Make the due calculation safe against extreme inputs, and explicitly handle thresholds that encompass a newly issued certificate’s entire validity period.

Validation

Test int.MaxValue, values representable as TimeSpan but invalid for date subtraction, and a threshold exceeding the issued certificate’s lifetime. Invalid refreshes should retain the previous valid snapshot.