Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,46 @@
+---
+tags:
+  - security
+  - proof-of-concept
+  - protobuf
+license: mit
+---
+
+# Protocol Buffers MetricDescriptor monitored_resource_types materialization DoS PoC
+
+This repository contains a benign security research PoC for a protobuf binary
+artifact that drives large repeated-string materialization during
+`google.api.metric_pb2.MetricDescriptor.ParseFromString(...)`.
+
+Files:
+
+- `control_one_display_name.pb`
+- `malicious_monitored_resource_types_6000000.pb`
+- `reproduce.py`
+
+Observed behavior:
+
+- control artifact:
+  - parses successfully with zero `monitored_resource_types`
+- malicious artifact:
+  - both files are `12,000,000` bytes
+  - parses successfully with `6,000,000` `monitored_resource_types` entries
+  - increases peak RSS by about `213988 kB` in local clean-process replay
+  - takes about `15.42x` the control parse time
+
+Tested runtime:
+
+- `protobuf==7.35.1`
+- Python: `/usr/bin/python3`
+
+Public files:
+
+- `https://huggingface.co/hacnho/protobuf-metricdescriptor-monitored-resource-types-dos-poc/resolve/main/control_one_display_name.pb`
+- `https://huggingface.co/hacnho/protobuf-metricdescriptor-monitored-resource-types-dos-poc/resolve/main/malicious_monitored_resource_types_6000000.pb`
+- `https://huggingface.co/hacnho/protobuf-metricdescriptor-monitored-resource-types-dos-poc/resolve/main/reproduce.py`
+
+Reproduction:
+
+```bash
+python3 reproduce.py
+```