ag-ui-protocol / ag-ui-protocol/ag-ui

[BUG]: Kotlin community SDK: StackOverflowError escapes `catch(Exception)`; unbounded accumulators in several community SDKs

未關閉
#2,442 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
15.9k
分支
1.4k
平均合併
1 天 17 小時
30 天內合併 PR
163

描述

# Kotlin community SDK: StackOverflowError escapes `catch(Exception)`; unbounded accumulators in several community SDKs

Repository: https://github.com/ag-ui-protocol/ag-ui
Affected: community Kotlin SDK (`SseParser.kt:28-37`) and related items listed below
CWE: CWE-755 (Improper Handling of Exceptional Conditions), CWE-400 (Uncontrolled Resource Consumption)

## Summary (Kotlin)

Event JSON is parsed with kotlinx.serialization without a depth limit. Deeply nested JSON throws `StackOverflowError` — an `Error`, not an `Exception` — which escapes the parser's `catch(Exception)` handler and terminates the JVM/Android process.

## Related unbounded-accumulation items (CWE-400)

- Java client — `HttpAgent.java:107`: no bound on line length
- Dart — data-size cap checked only after accumulation begins (ordering gap)
- Kotlin — tool-call argument and reasoning-content accumulators unbounded
- Rust — UTF-8 sequences split across chunk boundaries mishandled

## Impact

Process termination (Kotlin stack-overflow path) or gradual unbounded memory growth (the accumulation items), triggered by a malicious or misbehaving agent endpoint. Availability only.

## Suggested remediation

- Catch `Throwable` (or `Error`) around parsing, or enforce a parse-depth limit before decoding.
- Apply the Dart SDK's reference cap set (event/id/data size, total budget) across the community SDKs.

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。