Skip to content
This repository was archived by the owner on Sep 30, 2024. It is now read-only.

fix/frontend/httpapi: improve request reader#63923

Merged
evict merged 3 commits into
mainfrom
gzip-limitreader
Jul 19, 2024
Merged

fix/frontend/httpapi: improve request reader#63923
evict merged 3 commits into
mainfrom
gzip-limitreader

Conversation

@bobheadxi

@bobheadxi bobheadxi commented Jul 18, 2024

Copy link
Copy Markdown
Member

This sets a maximum decompressed size limit for requests of 20MiB. For more details, please refer to: https://github.com/sourcegraph/security-issues/issues/398.

Test plan

Tested locally, the limit reader works as intended.

@cla-bot cla-bot Bot added the cla-signed label Jul 18, 2024
@evict evict changed the title fix/frontend/httpapi: limit gzip reader size fix/frontend/httpapi: improve request readerr Jul 18, 2024
@bobheadxi bobheadxi changed the title fix/frontend/httpapi: improve request readerr fix/frontend/httpapi: improve request reader Jul 18, 2024
@evict evict requested a review from a team July 19, 2024 14:20
@evict evict force-pushed the gzip-limitreader branch from 0ae2290 to d5c64b8 Compare July 19, 2024 14:22
@evict evict requested a review from keegancsmith July 19, 2024 14:23
@evict evict force-pushed the gzip-limitreader branch from d5c64b8 to 47b7173 Compare July 19, 2024 14:50
Comment thread cmd/frontend/internal/httpapi/graphql.go Outdated
@evict evict force-pushed the gzip-limitreader branch 2 times, most recently from a3b5801 to 3d1b082 Compare July 19, 2024 17:50
bobheadxi and others added 3 commits July 19, 2024 18:53
It's very unlikely someone is going to exceed this from our GraphQL API.
20MiB is a lot for a single decompressed request.

bazel
@evict evict force-pushed the gzip-limitreader branch from 3d1b082 to 200eb4f Compare July 19, 2024 17:53
@evict evict self-requested a review July 19, 2024 18:10
@evict evict merged commit d73e463 into main Jul 19, 2024
@evict evict deleted the gzip-limitreader branch July 19, 2024 18:10
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants