You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/12 17:42:27 UTC
[I] [Studio][Security] Bound Claude Code streaming process output [rocketmq-dashboard]
youngkermit8-coder opened a new issue, #2040:
URL: https://github.com/apache/rocketmq-dashboard/issues/2040
## Problem
`ClaudeCodeAgentProvider.stream()` drains the Claude CLI's stdout and stderr without an output-size limit. Stdout is consumed through `BufferedReader.readLine()`, so one unbounded stream-json line can grow in memory before parsing, while stderr is collected with `readAllBytes()`. The fallback result text can also retain an arbitrarily large payload.
A misbehaving or compromised upstream reached through the Claude CLI can therefore make the Studio process buffer unbounded child-process output and exhaust the JVM heap. The non-streaming CLI path has separate bounded-output work, but the Claude streaming implementation does not use that path.
## Expected behavior
Bound the combined stdout/stderr bytes consumed from a Claude streaming process. If the limit is exceeded, terminate the child process and return a structured `llm.provider.output_too_large` error. Normal stream-json parsing and output below the limit should remain unchanged.
## Suggested verification
- oversized stdout is rejected and the process is terminated
- oversized stderr is rejected and the process is terminated
- existing large-but-bounded stderr draining still succeeds
- regular streamed/fallback result handling is unchanged
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Bound Claude Code streaming process output [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #2040:
URL: https://github.com/apache/rocketmq-dashboard/issues/2040#issuecomment-5270797042
**Issue Evaluation**
Category: `bug` | Status: **Needs Info**
Thank you for the detailed report. However, I was unable to verify this issue against the current codebase.
**Verification result:**
- The class `ClaudeCodeAgentProvider` does not exist in the `master` branch or any remote branch of this repository.
- No `Studio` module or Claude Code integration code was found in the current codebase.
- The repository currently contains the standard RocketMQ Dashboard (cluster management UI) without LLM/AI agent features.
**Questions:**
- Which branch or fork does this issue target?
- Is there a `Studio` feature branch that hasn't been pushed to the remote yet?
- Could this issue have been filed against a different repository?
Please clarify so we can proceed with proper verification.
---
*Automated evaluation by RockteMQ-AI*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Bound Claude Code streaming process output [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #2040:
URL: https://github.com/apache/rocketmq-dashboard/issues/2040#issuecomment-5723041586
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Bound Claude Code streaming process output [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #2040: [Studio][Security] Bound Claude Code streaming process output
URL: https://github.com/apache/rocketmq-dashboard/issues/2040
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org