wy471x opened a new pull request, #6458: URL: https://github.com/apache/shenyu/pull/6458
PullSwaggerDocServiceImpl previously called response.body().string() with no size limit, allowing a malicious upstream to exhaust admin memory. Extract readLimitedResponseBody to a public static method in HttpUtils with Content-Length pre-check and streaming byte-count enforcement, reuse it in both SwaggerImportServiceImpl and PullSwaggerDocServiceImpl, and gate it with the existing shenyu.swagger.max-body-size property (default 10 MB). <!-- Describe your PR here; e.g. Fixes #issueNo --> <!-- Thank you for proposing a pull request. This template will guide you through the essential steps necessary for a pull request. --> Make sure that: - [X] You have read the [contribution guidelines](https://shenyu.apache.org/community/contributor-guide). - [X] You submit test cases (unit or integration tests) that back your changes. - [X] Your local test passed `./mvnw clean install -Dmaven.javadoc.skip=true`. summary of all changes: Problem PullSwaggerDocServiceImpl called response.body().string() directly, loading the entire upstream API document response into memory with no size limit. A malicious or misconfigured upstream could cause excessive memory usage in shenyu-admin. ## Solution 3 production files changed, 2 test files changed: 1. HttpUtils.java — Extracted readLimitedResponseBody() as a public static method (moved from SwaggerImportServiceImpl where it was private). Implements two-layer defense: early rejection via Content-Length header check, and streaming byte-count enforcement. Pre-allocates ByteArrayOutputStream when contentLength is known to avoid repeated buffer resizing. 2. SwaggerImportServiceImpl.java — Delegates to HttpUtils.readLimitedResponseBody() instead of the removed private method. Removed unused imports, the READ_BUFFER_SIZE constant, and the dead DEFAULT_MAX_SWAGGER_BODY_SIZE constant. 3. PullSwaggerDocServiceImpl.java — The core fix. Added @Value("${shenyu.swagger.max-body-size:10485760}") injection and replaced response.body().string() with HttpUtils.readLimitedResponseBody(response.body(), maxSwaggerBodySize). Oversized responses are caught by the existing catch (Exception e) block and logged gracefully. 4. HttpUtilsTest.java — 8 new tests for readLimitedResponseBody: within-limit, exact-limit boundary, Content-Length rejection, streaming rejection, null body, negative max size, charset handling (ISO-8859-1), and default UTF-8 fallback. 5. SwaggerImportServiceImplTest.java — Removed 3 reflection-based tests that called the now-deleted private method (covered by HttpUtilsTest). Moved service creation to @BeforeEach with ReflectionTestUtils.setField to simulate Spring injection of the default 10 MB limit. close [#6444](https://github.com/apache/shenyu/issues/6444) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
