LuoYushi7 opened a new pull request, #4757:
URL: https://github.com/apache/rocketmq-dashboard/pull/4757
### Brief Description
`Client.request` read the whole Studio response body with an unbounded
`io.ReadAll`, so a Studio Server (or an intermediary gateway or proxy) that
streams a body without end grew the rmqctl process until it was killed, with
no
diagnostic naming the response body.
The read now goes through `io.LimitReader` against
`clientResponseBodyLimit` (32 MiB, mirroring the module's existing
`stdioMaxLineBytes` and `statusErrorBodyLimit` conventions) and fails with
`studio response body exceeds N bytes` once the body passes the cap. The
error
names the cause instead of surfacing later as a JSON decode error on a
payload
that was never meant to be that large.
The cap is a package variable rather than a constant so a test can lower it
instead of materializing a 32 MiB body.
### Tests
`rmqctl/internal/studio/client_test.go`:
* `TestRequestRejectsResponseBodyAboveLimit` — an oversized body is refused,
and
the test asserts how many bytes the client actually pulled from the
reader, so
it also pins that the read stopped rather than buffering everything.
* `TestRequestAcceptsResponseBodyAtLimit` — a body that fits still decodes,
so
the cap does not reject ordinary responses.
Fail-before: with the unmodified `request`, the first test fails with
`invalid studio response: invalid character 'x' looking for beginning of
value`.
```
go test ./... # all rmqctl packages pass
go vet ./internal/studio/
```
Fixes #4756
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
