CSV/RTF: bound cell/text materialization to prevent memory exhaustion
- Dominant language
- Rust
- Stars
- 21.5k
- Forks
- 1.3k
- Avg merge
- 42m
- Merged PRs (30d)
- 17
Description
## Problem
The CSV and RTF parsers appear to materialize cells/text without a bound on the number of cells or the decompressed text size. A crafted (or accidentally pathological) CSV/RTF input could exhaust memory during conversion.
## Expected outcome
Enforce limits analogous to the existing `max_entry_bytes`/resource-limit checks (or a row/cell count cap) for CSV/RTF, surfacing a `resourceLimit` error instead of unbounded allocation.
## Context
Raised while adopting `firecrawl-anydoc` 0.1.9 as a Python dependency (GroktoCrawl parse-svc). Applies to the Rust core and all bindings. A 50 MB request cap in the consuming service is only a partial mitigation.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the CSV and RTF parsers and the existing max_entry_bytes/resource-limit checks in the Rust core. Exercise the parsers with oversized or high-cell-count inputs, then verify that bounded processing returns a resourceLimit error across the Python and Node.js bindings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, python, rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100