CRITICALCWE-755
PEI-009 Exception Handler Policy Bypass
Policy Enforcement Integrity: Attacks that bypass policy enforcement via threshold fallbacks, config file injection, or parser error paths that fail open
Description
Tests if triggering an exception in the enforcement engine causes it to skip enforcement entirely
Remediation
Enforcement engine exceptions (timeout, overflow, parse error) must always result in DENY. Wrap policy evaluation in a catch-all that defaults to DENY. Set reasonable limits on rule count with DENY on overflow.