ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Kotlin community SDK: StackOverflowError escapes `catch(Exception)`; unbounded accumulators in several community SDKs

Đang mở
#2,442 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Python
Star
15.9k
Fork
1.4k
Merge trung bình
1 ngày 17 giờ
Pull request đã merge (30 ngày)
163

Mô tả

# Kotlin community SDK: StackOverflowError escapes `catch(Exception)`; unbounded accumulators in several community SDKs

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Kotlin SDK (`SseParser.kt:28-37`) and related items listed below
CWE: CWE-755 (Improper Handling of Exceptional Conditions), CWE-400 (Uncontrolled Resource Consumption)

## Summary (Kotlin)

Event JSON is parsed with kotlinx.serialization without a depth limit. Deeply nested JSON throws `StackOverflowError` — an `Error`, not an `Exception` — which escapes the parser's `catch(Exception)` handler and terminates the JVM/Android process.

## Related unbounded-accumulation items (CWE-400)

- Java client — `HttpAgent.java:107`: no bound on line length
- Dart — data-size cap checked only after accumulation begins (ordering gap)
- Kotlin — tool-call argument and reasoning-content accumulators unbounded
- Rust — UTF-8 sequences split across chunk boundaries mishandled

## Impact

Process termination (Kotlin stack-overflow path) or gradual unbounded memory growth (the accumulation items), triggered by a malicious or misbehaving agent endpoint. Availability only.

## Suggested remediation

- Catch `Throwable` (or `Error`) around parsing, or enforce a parse-depth limit before decoding.
- Apply the Dart SDK's reference cap set (event/id/data size, total budget) across the community SDKs.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.