matryer / matryer/xbar

Using io.ReadAll(res.Body) is dangerous

Open
#809 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
18.1k
Forks
656
PR merge metrics
No merged PRs in 30d

Description

Hello!

Excuse me, but using
content, err := io.ReadAll(res.Body)
is dangerous.
A misbehaving service, compromised or fake service may send more data than expected and fill up loads of memory, maybe even crash your program and computer.
This is easily prevented by using io.LimitReader(res.Body, limit), to set a maximum limit.

Have a very good day!

Contributor guide

No contributing guide indexed for this repository

Research direction

Search the repository for io.ReadAll(res.Body) and inspect the surrounding response-handling entry point. Confirm which response reads need a bounded size, then verify that the relevant existing behavior remains covered by the repository's tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.