LuoYushi7 opened a new issue, #4756:
URL: https://github.com/apache/rocketmq-dashboard/issues/4756
### Environment
* rmqctl on the `rocketmq-studio` branch
* Go toolchain per `rmqctl/go.mod`
### What happened
`Client.request` reads the whole Studio response body with an unbounded
`io.ReadAll`:
```go
// rmqctl/internal/studio/client.go
defer response.Body.Close()
data, err := io.ReadAll(response.Body)
```
Nothing bounds that read. A Studio Server (or an intermediary gateway or
proxy)
that streams a body without end makes the rmqctl process grow its heap until
it
is killed, and the operator sees no diagnostic that names the response body.
The same package already caps the equivalent read on the error path:
`readMCPHTTPStatusError` uses `io.LimitReader(body, statusErrorBodyLimit+1)`
and
rejects anything past the limit (`rmqctl/internal/studio/mcp_http.go`). The
success path has no equivalent. `stdioMaxLineBytes` shows the module bounds
its
other unbounded inputs too.
### Steps to Reproduce
1. Point rmqctl at a Studio Server whose response body never ends (a stub
that
streams bytes, or a stuck gateway).
2. Run any command that issues a Studio API request, for example `rmqctl
cluster list`.
3. rmqctl buffers the body in memory until the process is killed.
### What Did You Expect to See?
The client stops reading at a bounded size and fails with an error that
names the
cause, so a runaway body is distinguishable from a malformed one.
### What Did You See Instead?
The body is buffered without limit, and an oversized body is only rejected
later
by the JSON decoder as `invalid studio response: invalid character ...`,
which
misattributes the failure.
### Additional Context
A regression test that sets the cap below the body size fails on unmodified
`rocketmq-studio` with `request() error = invalid studio response: invalid
character 'x' looking for beginning of value` — the decoder complains
instead of
the read stopping at the cap.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
