ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: C++ community SDK: per-event accumulator bypasses the chunk cap; JSON parsing has no depth limit

Aperta
#2,440 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
15.9k
Fork
1.4k
Merge medio
1g 17h
PR unite (30g)
163

Descrizione

# C++ community SDK: per-event accumulator bypasses the chunk cap; JSON parsing has no depth limit

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community C++ SDK — `src/stream/sse_parser.cpp:6-126`, `src/agent/http_agent.cpp:389`
CWE: CWE-400 (Uncontrolled Resource Consumption), CWE-674 (Uncontrolled Recursion)

## Summary

1. The 10 MB size cap is checked against the chunk buffer only; the per-event accumulator (`m_currentData`) grows without bound, so a single oversized event (delivered in many small chunks) bypasses the cap.
2. Event payloads are parsed with nlohmann::json without a depth limit; deeply nested JSON triggers unbounded recursion during parsing.

## Impact

Memory exhaustion via oversized single events, and hard process crashes (stack overflow / SIGSEGV) from maliciously nested JSON. Availability only.

## Suggested remediation

- Apply the size cap to the per-event accumulator, not only the chunk buffer.
- Configure an nlohmann parsing depth limit (or use an iterative parser).

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.