Frun1na opened a new pull request, #4639:
URL: https://github.com/apache/rocketmq-dashboard/pull/4639

   ## Which Issue(s) This PR Fixes
   
   Fixes #<to-be-filled>
   
   ## Brief Description
   
   `Client.request` in `rmqctl/internal/studio/client.go` reads the Studio API 
response body with an unbounded `io.ReadAll`. Every response is a JSON envelope 
that never legitimately approaches a large size, but a misbehaving or 
compromised Studio endpoint could stream an arbitrarily large body and exhaust 
the CLI's memory before any validation runs.
   
   This PR caps the accepted response body at 64 MiB via `io.LimitReader` and 
rejects anything larger with a clear error (`studio response exceeds 67108864 
bytes`) instead of buffering unboundedly. The cap is a package-level variable 
so tests can exercise the boundary.
   
   Note for reviewers: #4627 also touches `request` in this file (the 
non-positive `--timeout` guard); the two changes are in different hunks and 
should not conflict.
   
   ## How Did You Test This Change?
   
   ```
   $ cd rmqctl && go test ./...
   ok   github.com/apache/rocketmq-dashboard/rmqctl/internal/studio
   (no failures across the module)
   
   $ go test ./internal/studio/ -run TestRequestRejectsOversizedResponseBody
   ok   github.com/apache/rocketmq-dashboard/rmqctl/internal/studio
   ```
   
   The new test shrinks the cap to 1 KiB against a server that writes 4 KiB and 
asserts the request fails with the size error; with the unfixed code the body 
is buffered and the call instead fails later with a JSON parse error.
   
   `go vet ./...` and `gofmt -l .` are clean.
   
   ## Checklist
   
   - [x] I have performed a self-review of the code
   - [x] New tests cover the change
   - [x] The change follows the existing code style
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to