rclone

mirror/rclone

0 Fork 0

mirror of https://github.com/rclone/rclone.git synced 2026-10-10 15:01:37 -04:00

Files

T

Nick Craig-Wood 90e67915c8 rest: limit the size of HTTP response bodies read into memory

rest.ReadBody read the whole response body into memory with no limit.
It is used by the default error handler and by many backends' error
handlers and small API calls, so a server which answered with an error
status and then streamed an endless body could make rclone allocate
memory until it was killed.

ReadBody now reads at most 10 MiB (the same limit drainAndClose
already uses to discard unread bodies) and returns an error if the
body is bigger than that. Every caller reads small API responses -
error bodies, status documents and upload tokens - so no legitimate
response is affected.

Reported by @manus-pi

2026-09-23 11:16:37 +01:00

headers_test.go

lib/rest: validate ranged responses

2026-08-14 18:40:40 +02:00

headers.go

lib/rest: make ParseContentRange public

2026-08-24 18:16:12 +01:00

rest_test.go

rest: limit the size of HTTP response bodies read into memory

2026-09-23 11:16:37 +01:00

rest.go

rest: limit the size of HTTP response bodies read into memory