tarmac
tarmac copied to clipboard
http callback: Limit response body size to prevent excessive memory usage
Limit response body size to prevent excessive memory usage
Reading the entire response body without limits can cause high memory consumption if the response is large, potentially leading to Denial of Service (DoS) attacks. Consider limiting the size of the response body read to prevent such issues.
Apply this diff to limit the response body size to 10 MB:
body, err := io.ReadAll(response.Body)
+// Limit the response body to 10 MB
+body, err := io.ReadAll(io.LimitReader(response.Body, 10*1024*1024))
The above is a suggestion from CodeRabbit from a Pull Request Review, and I think it makes a lot of sense. I'm saving this to think about how I want to attack this: either a global max size, a definable size with the HTTP callback, or a combination of the two (probably this one).