Using io.ReadAll(res.Body) is dangerous
- Dominant language
- Go
- Stars
- 18.1k
- Forks
- 656
- PR merge metrics
- No merged PRs in 30d
Description
Hello!
Excuse me, but using
content, err := io.ReadAll(res.Body)
is dangerous.
A misbehaving service, compromised or fake service may send more data than expected and fill up loads of memory, maybe even crash your program and computer.
This is easily prevented by using io.LimitReader(res.Body, limit), to set a maximum limit.
Have a very good day!
Contributor guide
No contributing guide indexed for this repository
Research direction
Search the repository for io.ReadAll(res.Body) and inspect the surrounding response-handling entry point. Confirm which response reads need a bounded size, then verify that the relevant existing behavior remains covered by the repository's tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100