spuru9 commented on code in PR #1181:
URL:
https://github.com/apache/flink-kubernetes-operator/pull/1181#discussion_r3802896825
##########
flink-kubernetes-operator/src/main/java/org/apache/flink/kubernetes/operator/autoscaler/state/KubernetesAutoScalerStateStore.java:
##########
@@ -80,6 +80,12 @@ public class KubernetesAutoScalerStateStore
@VisibleForTesting protected static final int MAX_CM_BYTES = 1000000;
+ /* Caps the size of a single decompressed value so that a
crafted/corrupted ConfigMap
+ * entry (e.g. a gzip bomb) cannot exhaust operator memory during
decompression. Matches
+ * the YAML loader's code point limit below, since larger content would be
rejected by
+ * the YAML parser anyway. */
+ @VisibleForTesting protected static final int MAX_DECOMPRESSED_BYTES = 20
* 1024 * 1024;
Review Comment:
As ~4MB is real ceiling. Dropping the value to 8MB with some headspace. Let
me know if thats ok.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
