Frun1na opened a new pull request, #4639: URL: https://github.com/apache/rocketmq-dashboard/pull/4639
## Which Issue(s) This PR Fixes Fixes #<to-be-filled> ## Brief Description `Client.request` in `rmqctl/internal/studio/client.go` reads the Studio API response body with an unbounded `io.ReadAll`. Every response is a JSON envelope that never legitimately approaches a large size, but a misbehaving or compromised Studio endpoint could stream an arbitrarily large body and exhaust the CLI's memory before any validation runs. This PR caps the accepted response body at 64 MiB via `io.LimitReader` and rejects anything larger with a clear error (`studio response exceeds 67108864 bytes`) instead of buffering unboundedly. The cap is a package-level variable so tests can exercise the boundary. Note for reviewers: #4627 also touches `request` in this file (the non-positive `--timeout` guard); the two changes are in different hunks and should not conflict. ## How Did You Test This Change? ``` $ cd rmqctl && go test ./... ok github.com/apache/rocketmq-dashboard/rmqctl/internal/studio (no failures across the module) $ go test ./internal/studio/ -run TestRequestRejectsOversizedResponseBody ok github.com/apache/rocketmq-dashboard/rmqctl/internal/studio ``` The new test shrinks the cap to 1 KiB against a server that writes 4 KiB and asserts the request fails with the size error; with the unfixed code the body is buffered and the call instead fails later with a JSON parse error. `go vet ./...` and `gofmt -l .` are clean. ## Checklist - [x] I have performed a self-review of the code - [x] New tests cover the change - [x] The change follows the existing code style -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
