+3 -1

internal/appherder/source.go

Reviewed

··· 193 193 return matches[0], nil 194 194 } 195 195 196 196 + const apiResponseLimit = 4 * 1024 * 1024 // 4 MiB; real API responses are a few KB 197 197 + 196 198 // decodeJSON decodes a JSON value from r, wrapping any error with desc. 197 199 func decodeJSON[T any](r io.Reader, desc string) (T, error) { 198 200 var value T 199 199 - if err := json.NewDecoder(r).Decode(&value); err != nil { 201 201 + if err := json.NewDecoder(io.LimitReader(r, apiResponseLimit)).Decode(&value); err != nil { 200 202 return value, fmt.Errorf("%s: %w", desc, err) 201 203 } 202 204 return value, nil

+1 -1

internal/appherder/source_zsync.go

Reviewed

··· 55 55 } 56 56 defer resp.Body.Close() 57 57 58 58 - header, err := parseZsyncHeader(resp.Body) 58 58 + header, err := parseZsyncHeader(io.LimitReader(resp.Body, apiResponseLimit)) 59 59 if err != nil { 60 60 return nil, fmt.Errorf("parse zsync control file %s: %w", zsyncURL, err) 61 61 }