tarmac icon indicating copy to clipboard operation
tarmac copied to clipboard

http callback: Limit response body size to prevent excessive memory usage

Open madflojo opened this issue 4 months ago • 0 comments

Limit response body size to prevent excessive memory usage

Reading the entire response body without limits can cause high memory consumption if the response is large, potentially leading to Denial of Service (DoS) attacks. Consider limiting the size of the response body read to prevent such issues.

Apply this diff to limit the response body size to 10 MB:

 body, err := io.ReadAll(response.Body)
+// Limit the response body to 10 MB
+body, err := io.ReadAll(io.LimitReader(response.Body, 10*1024*1024))

The above is a suggestion from CodeRabbit from a Pull Request Review, and I think it makes a lot of sense. I'm saving this to think about how I want to attack this: either a global max size, a definable size with the HTTP callback, or a combination of the two (probably this one).

madflojo avatar Oct 13 '24 14:10 madflojo