docs: added docs around potential decompressions bomb#10763
Merged
jasonsaayman merged 5 commits intov1.xfrom Apr 19, 2026
Merged
docs: added docs around potential decompressions bomb#10763jasonsaayman merged 5 commits intov1.xfrom
jasonsaayman merged 5 commits intov1.xfrom
Conversation
Contributor
There was a problem hiding this comment.
3 issues found across 9 files
Confidence score: 4/5
- This PR looks safe to merge with minimal risk because the reported issues are low-severity documentation problems (1–3/10) and do not indicate runtime or code-path regressions.
- The most important issue is in
docs/fr/pages/misc/security.md: it linksmaxBodyLengthto response decompression-bomb mitigation, which could mislead readers about request-vs-response limits in security guidance. - Pay close attention to
docs/fr/pages/misc/security.mdanddocs/zh/pages/misc/security.md- fix the incorrectmaxBodyLengthexplanation and clean up Chinese spacing/typography inconsistencies.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="docs/zh/pages/misc/security.md">
<violation number="1" location="docs/zh/pages/misc/security.md:7">
P3: Remove the stray space in the Chinese sentence (`分块 强制执行` → `分块强制执行`).</violation>
<violation number="2" location="docs/zh/pages/misc/security.md:20">
P3: Remove the extra space in `为不可信来源 选择合理的上限` for consistent Chinese typography.</violation>
</file>
<file name="docs/fr/pages/misc/security.md">
<violation number="1" location="docs/fr/pages/misc/security.md:7">
P3: Cette recommandation lie `maxBodyLength` à la mitigation des bombes de décompression de réponse, alors que cette limite concerne la taille du corps de requête (upload), pas la réponse.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by cubic
Adds a security notice to
axiosdocs and README about decompression-bomb risk and how to mitigate it withmaxContentLength/maxBodyLengthcaps. Aligns with AXI-198 and keeps defaults unchanged.Description
fr/zh.-1allow DoS via gzip/deflate/brotli; set explicit caps when calling untrusted servers.Docs
/docs/updated (en, es, fr, zh) and README links to security guide; publish site and add a release note highlighting the recommendation.Testing
Semantic version impact
Written for commit b5f2a09. Summary will update on new commits.