ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Java community SDK agent handler reads the entire request body into memory

未關閉
#2,441 2 則留言 0 個 reaction 已指派 1 人 已被 @Jokasa7 認領 在 GitHub 檢視
主要語言
Python
星號
15.9k
分支
1.4k
平均合併
1 天 17 小時
30 天內合併 PR
163

描述

# Java community SDK agent handler reads the entire request body into memory

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Java SDK — `JdkAgentHttpHandler.java:95`
CWE: CWE-400 (Uncontrolled Resource Consumption)

## Summary

The JDK HTTP handler reads the full request body with `readAllBytes()` before parsing, with no size limit.

## Impact

A single large POST to the agent endpoint allocates the entire body in heap; repeated requests exhaust server memory. Standard reverse-proxy body limits (where deployed) mitigate this, which is why this is filed as a hardening item rather than a standalone issue.

## Suggested remediation

Enforce a configurable maximum body size (Content-Length pre-check + bounded read) before parsing.

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。