Provider response body is accumulated unbounded #143

New issue

Closed

opened 2026-08-15 14:33:43 +00:00 by john · 0 comments

john commented

2026-08-15 14:33:43 +00:00

Owner

Source: deep dive F11 (size half only)
Verdict: AGREE - low

Claim as reviewed

Provider responses are concatenated into an unbounded string, so an unexpectedly large response or a proxy error page can consume arbitrary memory.

At HEAD `f354864` (v3.3.0)

cadence-core/bin/review-provider.mjs:524-530 - let data = ''; res.on('data', (c) => { data += c; }); with no byte ceiling and no destroy path.

Note

The deadline half of this finding was refuted separately - see the closed issue on the socket-inactivity timer. Only the size bound survives.

Bounded in practice by the host's wrapping command timeout. Fix: a max response-byte limit that destroys the request once crossed, and a capped sanitized excerpt rather than the whole body in HTTP failure envelopes.

**Source:** deep dive F11 (size half only) **Verdict:** AGREE - low ### Claim as reviewed Provider responses are concatenated into an unbounded string, so an unexpectedly large response or a proxy error page can consume arbitrary memory. ### At HEAD f354864 (v3.3.0) `cadence-core/bin/review-provider.mjs:524-530` - `let data = ''; res.on('data', (c) => { data += c; });` with no byte ceiling and no destroy path. ### Note The deadline half of this finding was refuted separately - see the closed issue on the socket-inactivity timer. Only the size bound survives. Bounded in practice by the host's wrapping command timeout. Fix: a max response-byte limit that destroys the request once crossed, and a capped sanitized excerpt rather than the whole body in HTTP failure envelopes.