Bound the scope3 identity-config response read
Maintainers usually reply within 1 day
A pull request for this has already been merged.
- #569 by @bokelley — merged
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start in targeting/identityconfig/scope3/source.go: the unbounded json.NewDecoder(resp.Body).Decode(&decoded) is near line 245, and the deferred close with an unbounded io.Copy(io.Discard, resp.Body) is near line 230. Re-check those lines on current main, then compare with the 1 MiB cap at router/router.go:794. Done means both reads are bounded with a local limit, with no dependency on adcp/v3/signing, and existing tests still pass.
Written by the indexing model from the issue text.
Description
Surfaced by the security review of #561 (response-size cap on signed HTTP clients). Same bug class, different module, so it was deliberately left out of that PR.
targeting/identityconfig/scope3/source.go reads a remote config endpoint with no size bound:
:245—json.NewDecoder(resp.Body).Decode(&decoded)with noio.LimitReader, so a hostile or misbehaving config endpoint can drive the process out of memory. This is the same failure mode as #561: a 17.8 MB response OOM-killed the hosted compliance worker.:230— the deferred close does an unboundedio.Copy(io.Discard, resp.Body). A never-ending body hangs there indefinitely.
Every other agent-facing read in the tree is already capped: router/router.go:794 (1 MiB), tmpclient/client.go:226 (1 MiB), registry/client.go (10 MiB).
Suggested fix: bound the decode with an explicit limit in the same style as the router, and bound (or drop) the drain in the deferred close. targeting has no dependency on adcp/v3/signing, so this wants a local limit rather than reuse of signing.ResponseLimitTransport.
Line numbers are from main at 539631e — re-verify before working on it.
- Dominant language
- Go
- Stars
- 4
- Forks
- 2
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 26
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from adcontextprotocol/adcp-go
-
CreativeInput carries no revision_id or localization (follow-up to #545)Possibly taken @sujanchalla0510 claimed this 14 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
adcontextprotocol/adcp-go#567 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
adcontextprotocol/adcp-go#600 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 38/100
adcontextprotocol/adcp-go#597 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
adcontextprotocol/adcp-go#590 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
adcontextprotocol/adcp-go#588 · 3 comments ·
Maintainers usually reply within 1 day
All issues in adcontextprotocol/adcp-go
Similar issues
-
date_time, url_encode, html_escape, to_unix_time, contains_all and contains_any panic when called without argumentsPossibly taken @antcybersec claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
projectdiscovery/dsl#372 ·
Maintainers usually reply within 1 day
-
blocked-needs-validation
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
projectcapsule/capsule#2265 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
JuliusBrussee/caveman#1449 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
bot-found bug priority: P3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
madenvel/KalinkaPlayer#498 ·