youngkermit8-coder opened a new issue, #1724: URL: https://github.com/apache/rocketmq-dashboard/issues/1724
## Problem `OpenAiCompatibleLlmClient` buffers provider responses without a size limit: - `complete()` and `listModels()` use `HttpResponse.BodyHandlers.ofString()`, which materializes the full body in JVM heap. - the streaming error path calls `readAllBytes()` before mapping an upstream error. The existing request timeout limits duration but not response size. A misconfigured, compromised, or local OpenAI-compatible endpoint can therefore return an arbitrarily large body and consume the Studio process heap from a single request. This is independent from #1719/#1721, which covers CLI child-process output rather than HTTP provider responses. ## Proposed change - consume completion, model-list, and streaming error bodies through one bounded reader - close each response stream after reading - return a structured gateway error when the configured cap is exceeded - retain existing parsing and upstream-error behavior for responses within the cap - add regression coverage for oversized completion/model responses and the exact boundary ## Acceptance criteria - no non-streaming OpenAI-compatible provider response is buffered without a hard cap - oversized responses fail deterministically without parsing the remaining body - normal responses at or below the cap retain their current behavior - focused AI client tests and Checkstyle pass -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
