* test(core,cli): pin DoS-resistance of CSI deserialisers (ADR-127 security review)
Beyond-SOTA security review of wifi-densepose-core + wifi-densepose-cli.
Load-bearing-question verdict: the NaN-state-poisoning bug class does NOT
originate in core — core exposes no stateful accumulator (no Welford,
von-Mises, IIR, voxel grid, running mean); each downstream crate rolls its
own, so each fix is correctly local. Both crates confirmed clean on every
reviewed dimension (panic-on-adversarial-input, NaN handling, unbounded
memory, path traversal, secrets) — no production code changed.
Adds 4 regression pins locking in two existing-but-untested DoS guards:
- core: from_canonical_bytes shape guard (Vec::with_capacity bound) — proven
to fail with `capacity overflow` when the saturating-mul guard is removed.
- core: canonical decoder never panics on arbitrary/truncated bytes.
- cli: parse_csi_packet rejects an oversized n_antennas*n_subcarriers claim
before Array2 allocation (33 MB claim in a 2 KB datagram -> None).
- cli: parse_csi_packet never panics on arbitrary UDP bytes.
core: 35 -> 37 lib tests; cli: 24 -> 26 tests; 0 failed. Python proof
unchanged (f8e76f21…46f7a — off the signal path).
Co-Authored-By: claude-flow <ruv@ruv.net>
* docs(adr): ADR-172 — wifi-densepose-cli + core CSI-deserialiser security review
Records the clean-with-evidence verdict + 4 DoS-resistance regression pins
(test-only, committed in
|
||
|---|---|---|
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
README.md
wifi-densepose-core
Core types, traits, and utilities for the WiFi-DensePose pose estimation system.
Overview
wifi-densepose-core is the foundation crate for the WiFi-DensePose workspace. It defines the
shared data structures, error types, and trait contracts used by every other crate in the
ecosystem. The crate is no_std-compatible (with the std feature disabled) and forbids all
unsafe code.
Features
- Core data types --
CsiFrame,ProcessedSignal,PoseEstimate,PersonPose,Keypoint,KeypointType,BoundingBox,Confidence,Timestamp, and more. - Trait abstractions --
SignalProcessor,NeuralInference, andDataStoredefine the contracts for signal processing, neural network inference, and data persistence respectively. - Error hierarchy --
CoreError,SignalError,InferenceError, andStorageErrorprovide typed error handling across subsystem boundaries. no_stdsupport -- Disable the defaultstdfeature for embedded or WASM targets.- Constants --
MAX_KEYPOINTS(17, COCO format),MAX_SUBCARRIERS(256),DEFAULT_CONFIDENCE_THRESHOLD(0.5).
Feature flags
| Flag | Default | Description |
|---|---|---|
std |
yes | Enable standard library support |
serde |
no | Serialization via serde (+ ndarray serde) |
async |
no | Async trait definitions via async-trait |
Quick Start
use wifi_densepose_core::{CsiFrame, Keypoint, KeypointType, Confidence};
// Create a keypoint with high confidence
let keypoint = Keypoint::new(
KeypointType::Nose,
0.5,
0.3,
Confidence::new(0.95).unwrap(),
);
assert!(keypoint.is_visible());
Or use the prelude for convenient bulk imports:
use wifi_densepose_core::prelude::*;
Architecture
wifi-densepose-core/src/
lib.rs -- Re-exports, constants, prelude
types.rs -- CsiFrame, PoseEstimate, Keypoint, etc.
traits.rs -- SignalProcessor, NeuralInference, DataStore
error.rs -- CoreError, SignalError, InferenceError, StorageError
utils.rs -- Shared helper functions
Related Crates
| Crate | Role |
|---|---|
wifi-densepose-signal |
CSI signal processing algorithms |
wifi-densepose-nn |
Neural network inference backends |
wifi-densepose-train |
Training pipeline with ruvector |
wifi-densepose-mat |
Disaster detection (MAT) |
wifi-densepose-hardware |
Hardware sensor interfaces |
wifi-densepose-vitals |
Vital sign extraction |
wifi-densepose-wifiscan |
Multi-BSSID WiFi scanning |
License
MIT OR Apache-2.0