ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Java community SDK agent handler reads the entire request body into memory

未关闭
#2,441 2 条评论 0 个 reaction 已指派 1 人 已被 @Jokasa7 认领 在 GitHub 查看
主要语言
Python
星标
15.9k
派生
1.4k
平均合并
1 天 17 小时
30 天内合并 PR
163

描述

# Java community SDK agent handler reads the entire request body into memory

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.

## Impact

A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.

## Suggested remediation

Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。