Security & untrusted input¶

Security decisions depend on the data format chosen at ingress and the validation run before trusting parsed geometry.

Accepted untrusted formats¶

Use these formats for untrusted data contents:

WKB/EWKB via gm.from_wkb;
WKT/EWKT via gm.from_wkt;
GeoJSON via gm.from_geojson, including feature metadata with features=True;
Arrow/GeoArrow/GeoParquet after accepting the provider as a trusted ABI participant; the buffers and geometry values are still treated as untrusted contents.

The readers fail fast with structured ParseError, CRSError, InvalidGeometryError, or GeometryError. Parse untrusted bytes with these readers, catch the structured exception, then validate or repair only the rows your workflow accepts:

import gometry as gm

payloads = [
    b"\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0?\x00\x00\x00\x00\x00\x00\x00@",
    b"not wkb",
]

for payload in payloads:
    try:
        geom = gm.from_wkb(payload, crs=4326)
    except gm.ParseError as err:
        print("rejected", err.format)
    else:
        print("accepted", geom.to_wkt())

accepted POINT (1 2)
rejected wkb

Validate topology with geom.validate() / arr.is_valid, and call repair() where the workflow accepts repaired shapes.

Ingress threat model¶

gometry is an ordinary native extension (like pyarrow, numpy, or polars), not a sandbox. Its ingress boundaries validate the structures they consume: for example, Arrow offsets and validity, buffer spans, and supported encoding shapes are checked before decoding. These checks reject malformed structure; they do not impose a general payload-size or CPU limit. Arrow providers must also obey the exported structures, readable spans, capsule names, and release callbacks; see Arrow C capsule trust model.

Collection and allocation¶

Construction consumes the supplied iterable and may reserve memory from its reported length. There is no universal element limit; an unbounded iterable can keep consuming memory and CPU.

Python-provider exceptions propagate. Native allocation failure can abort the process rather than raise a catchable MemoryError. Limit untrusted payload sizes and batch lengths before passing them to the extension.

Generated-output and work limits¶

Coverage factories and H3 traversal methods default to max_cells=1_000_000; passing max_cells=None removes that output-count limit. This limit does not set a CPU deadline for classification or traversal. WKT, WKB, and GeoJSON parsers reject excessive recursive nesting, but impose no general byte or feature-count ceiling. CellArray.uncompact has no result-count limit.

Other limits belong to specific operations. When an operation documents a generated-output cap, ResourceLimitError.code is 'output_limit' for that refusal. A bounded exact search may return code == 'work_limit' when it stops before certification; that does not prove no acceptable result exists. An OverflowError with code == 'output_unrepresentable' means the operation could not represent its result while preserving the required topology. None of these operation-specific errors is a general CPU deadline or a global resource guarantee.

Syntactically valid geometry can still exhaust CPU or memory through enormous payloads, vertex counts, feature collections, or expensive topology. Run hostile or multi-tenant workloads in a process with OS memory/CPU limits and a timeout. Treat repair, overlay, validation, and exact spatial refinement as potentially expensive work after a successful parse. Python thread timeouts are not hard isolation.

Never unpickle untrusted data¶

pickle is for trusted Python object persistence only. It can execute Python code while loading. For untrusted or cross-service data, use WKB, WKT, GeoJSON, GeoArrow, or GeoParquet.

Reporting vulnerabilities¶

A suspected vulnerability goes to GitHub's private vulnerability reporting instead of the public issue tracker.

If private reporting is unavailable, contact the maintainers listed in package metadata. Security fixes ship in a normal release; Compatibility states the supported runtimes.