(dubbo-go) branch release-3.0 updated: fix(jsonrpc): Limit header size to avoid unexpected OOM (#2467)

[li...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

liujun pushed a commit to branch release-3.0
in repository https://gitbox.apache.org/repos/asf/dubbo-go.git


The following commit(s) were added to refs/heads/release-3.0 by this push:
     new c3e65ffd9 fix(jsonrpc): Limit header size to avoid unexpected OOM (#2467)
c3e65ffd9 is described below

commit c3e65ffd9ad52654fdf6a674a966d0d822ad0bc9
Author: Xuewei Niu <ju...@apache.org>
AuthorDate: Sun Oct 29 00:01:00 2023 +0800

    fix(jsonrpc): Limit header size to avoid unexpected OOM (#2467)
    
    This patch limits the max size of header to 8Mib to avoid OOM issues.
    
    Signed-off-by: Xuewei Niu <ju...@apache.org>
---
 protocol/jsonrpc/server.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/protocol/jsonrpc/server.go b/protocol/jsonrpc/server.go
index 4470cb277..2b3e9a769 100644
--- a/protocol/jsonrpc/server.go
+++ b/protocol/jsonrpc/server.go
@@ -57,6 +57,8 @@ const (
 	DefaultHTTPRspBufferSize = 1024
 	// PathPrefix ...
 	PathPrefix = byte('/')
+	// Max HTTP header size in Mib
+	MaxHeaderSize = 8 * 1024 * 1024
 )
 
 // Server is JSON RPC server wrapper
@@ -121,7 +123,7 @@ func (s *Server) handlePkg(conn net.Conn) {
 	}
 
 	for {
-		bufReader := bufio.NewReader(conn)
+		bufReader := bufio.NewReader(io.LimitReader(conn, MaxHeaderSize))
 		r, err := http.ReadRequest(bufReader)
 		if err != nil {
 			logger.Warnf("[ReadRequest] error: %v", err)