Nick Craig-Wood 90e67915c8 rest: limit the size of HTTP response bodies read into memory ...

rest.ReadBody read the whole response body into memory with no limit.
It is used by the default error handler and by many backends' error
handlers and small API calls, so a server which answered with an error
status and then streamed an endless body could make rclone allocate
memory until it was killed.

ReadBody now reads at most 10 MiB (the same limit drainAndClose
already uses to discard unread bodies) and returns an error if the
body is bigger than that. Every caller reads small API responses -
error bodies, status documents and upload tokens - so no legitimate
response is affected.

Reported by @manus-pi

2026-09-23 11:16:37 +01:00

..

headers_test.go

…

headers.go

…

rest_test.go

rest: limit the size of HTTP response bodies read into memory

2026-09-23 11:16:37 +01:00

rest.go

rest: limit the size of HTTP response bodies read into memory

2026-09-23 11:16:37 +01:00

url_test.go

…

url.go

…