ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Go community SDK accumulates SSE events without bounds

Aperta
#2,438 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
15.9k
Fork
1.4k
Merge medio
1g 17h
PR unite (30g)
163

Descrizione

# Go community SDK accumulates SSE events without bounds

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Go SDK — `sdks/community/go/pkg/client/sse/client.go:191-303`
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

The SSE client appends incoming event data, event lines, and id lines without per-item or total-size caps. Nothing bounds memory growth during a single stream.

## Impact

A misbehaving or malicious agent endpoint can grow the client's memory without limit over the course of one connection. Availability only — no code execution or data access.

## Suggested remediation

Adopt a cap set equivalent to the Dart SDK's reference implementation (per-event size, per-id size, total stream budget; Dart enforces an 8 MiB data cap, id length cap, and NUL rejection).

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.