Aias00 opened a new issue, #6444:
URL: https://github.com/apache/shenyu/issues/6444
### Current Behavior
`PullSwaggerDocServiceImpl` reads the entire upstream API document response
body into memory with no size limit.
Evidence:
-
`shenyu-admin/src/main/java/org/apache/shenyu/admin/service/manager/impl/PullSwaggerDocServiceImpl.java:96-105`
```java
String url = getSwaggerRequestUrl(instance);
try (Response response = HTTP_UTILS.requestForResponse(url,
Collections.emptyMap(), Collections.emptyMap(), HttpUtils.HTTPMethod.GET)) {
...
final String body = response.body().string();
docManager.addDocInfo(instance, body, ...);
}
```
This is separate from the manual Swagger import path.
`PullSwaggerDocServiceImpl` is triggered by service/selector document loading
and automatically requests `/v3/api-docs` from registered upstream instances.
A malicious or misconfigured upstream can return a very large response body
and cause excessive memory usage in `shenyu-admin`.
### Expected Behavior
Automatic API document pull should enforce the same kind of response size
limit used for manual Swagger/OpenAPI import, and should fail gracefully when
the upstream document exceeds the configured limit.
### Steps To Reproduce
1. Register or configure an upstream instance whose `/v3/api-docs` endpoint
returns a very large response body.
2. Trigger API document loading through selector/service doc refresh.
3. `PullSwaggerDocServiceImpl` calls `response.body().string()` and loads
the full response into memory before parsing.
### Suggested Fix
Read the response body with a counted stream and enforce a configurable
maximum before passing it to `docManager.addDocInfo(...)`. Also check
`Content-Length` when present.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
