Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

It is not safe to read all stream body to memory without a max size limit. #1765

Open
Quons opened this issue Apr 23, 2024 · 8 comments
Open

Comments

@Quons
Copy link

Quons commented Apr 23, 2024

_, err := copyZeroAlloc(bodyBuf, req.bodyStream)

I think it would be safe to stop reading the request body into memory and return an error when it exceeds the maximum request body size. Otherwise, it may lead to an out-of-memory (OOM) error when the request body is too large.

@Quons Quons changed the title It is not safe to read all stream body to memery without max size limit It is not safe to read all stream body to memory without a max size limit. Apr 23, 2024
@erikdubbelboer
Copy link
Collaborator

Users using body streaming on the server side should use Request.BodyStream() to get an io.Reader and read as much as they need. It's not recommended to to call Request.Body() to then get the full body. I agree that we should probably maybe do something here to prevent this. I'm open to a pull request or suggestion on how to fix this.

@byte0o
Copy link
Contributor

byte0o commented Jun 24, 2024

If you want to add a read data size limit to the Body function, can you abandon the Body function and only support BodyStream? BodyStream can satisfy the caller's control of the read data size.

@gaby
Copy link
Contributor

gaby commented Jul 13, 2024

@byte0o That would be a backward incompatible change, right?

@byte0o
Copy link
Contributor

byte0o commented Jul 14, 2024

@gab Yes, you can first mark the Body function as deprecated

@dojutsu-user
Copy link

@erikdubbelboer
I would like to start contributing to this.
From the above discussion, it seems that we can mark the Body() function as deprecated but it is getting used at many places in the same file. We should probably replace those also, right?

@erikdubbelboer
Copy link
Collaborator

@dojutsu-user maybe you can have a look at changing it so that Request.Body() prints a warning using Server.Logger (so only when used in a server context).

@dojutsu-user
Copy link

@erikdubbelboer We'll have to inject the Server.Logger instance in the request, right?
Currently, there's no logger that I can fine in the req.

@erikdubbelboer
Copy link
Collaborator

Yeah but keep it private, we don't want to expose that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants