pjfanning opened a new pull request, #818:
URL: https://github.com/apache/pekko-grpc/pull/818
What the fixes address:
1. Gzip Decompression Bomb — Gzip.uncompress(bytes, maxSize) now checks
cumulative output during decompression and throws RESOURCE_EXHAUSTED before OOM
2. No Max Message Size — GrpcFramingDecoderStage now validates frame length
against maxInboundMessageSize both before and after decompression
3. Negative Frame Length — Both strict and streaming decoders now reject
negative lengths with INTERNAL status
How users configure it:
hocon
pekko.grpc.client."*" {
max-inbound-message-size = 8388604 # 8 MiB
}
Or programmatically:
val settings = GrpcClientSettings.connectToServiceAt("localhost", 8080)
.withMaxInboundMessageSize(8 * 1024 * 1024)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
