External/spec-kit
1
0
Fork 0
mirror of https://github.com/github/spec-kit.git synced 2026-08-15 14:02:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: use bounded read for bundle download HTTP responses (#3764)

Browse Source 
* fix: use bounded read for bundle download HTTP responses

The bundle download used unbounded resp.read() to read HTTP responses
into memory. A malicious or misconfigured catalog server could return
an arbitrarily large payload causing OOM.

Replace with read_response_limited() capped at MAX_DOWNLOAD_BYTES
(50 MiB), consistent with how other download paths in the codebase
enforce bounded reads.

Add regression test that monkeypatches MAX_DOWNLOAD_BYTES to 100 bytes
and verifies oversized responses are rejected.

* fix: remove duplicate import of MAX_DOWNLOAD_BYTES and read_response_limited
This commit is contained in:
Quratulain-bilal
2026-08-12 08:29:36 -05:00
committed by GitHub
parent 7dd706880e
commit c1bceb625c
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/specify_cli/commands/bundle/__init__.py
+1 -1
View File
@@ -14,8 +14,8 @@ from pathlib import Path
import typer
from rich.markup import escape as _escape_markup
from ..._console import console, err_console
from ..._download_security import MAX_DOWNLOAD_BYTES, read_response_limited
from ..._console import console, err_console
from ...bundler import BundlerError
from ...bundler.lib.project import (
active_integration,