Remove ioutil.ReadAll, except for in tests, and set a message size limit #2138

New issue

Closed

opened 2026-03-04 01:47:52 -05:00 by deekerman · 0 comments

deekerman commented

2026-03-04 01:47:52 -05:00

Owner

Originally created by @ainar-g on GitHub (Nov 12, 2020).

Originally assigned to: @EugeneOne1 on GitHub.

ioutil.ReadAll should generally not be used in HTTP APIs, since it doesn't have a size limit. Our current HTTP API is for internal use, but it's still a good precautionary measure, in my opinion. We should probably just set a limit, constant or configurable, for the maximum size of an HTTP request body. Perhaps write our own version of io.LimitedReader that returns a meaningful error instead of an io.EOF.

Originally created by @ainar-g on GitHub (Nov 12, 2020). Originally assigned to: @EugeneOne1 on GitHub. <p><code>ioutil.ReadAll</code> should generally not be used in HTTP APIs, since it doesn't have a size limit. Our current HTTP API is for internal use, but it's still a good precautionary measure, in my opinion. We should probably just set a limit, constant or configurable, for the maximum size of an HTTP request body. Perhaps write our own version of <code>io.LimitedReader</code> that returns a meaningful error instead of an <code>io.EOF</code>.</p>

deekerman

2026-03-04 01:47:52 -05:00

closed this issue
added the
enhancement

P4: Low
labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/AdGuardHome#2138

No description provided.

Rows
Columns