From 64eff43fdb1fb9387e399ab2f255a555c6eb381f Mon Sep 17 00:00:00 2001 From: Poor12 Date: Wed, 9 Nov 2022 12:19:13 +0800 Subject: [PATCH] Add limitReader to io.ReadAll Signed-off-by: Poor12 --- pkg/karmadactl/cmdinit/utils/format.go | 4 +++- pkg/webhook/interpreter/http.go | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/pkg/karmadactl/cmdinit/utils/format.go b/pkg/karmadactl/cmdinit/utils/format.go index bda507857..b5f953bba 100644 --- a/pkg/karmadactl/cmdinit/utils/format.go +++ b/pkg/karmadactl/cmdinit/utils/format.go @@ -19,6 +19,8 @@ const ( // A split symbol that receives multiple values from a command flag separator = "," labelSeparator = "=" + // MaxRespBodyLength is the max length of http response body + MaxRespBodyLength = 1 << 20 // 1 MiB ) // IsExist Determine whether the path exists @@ -60,7 +62,7 @@ func InternetIP() (net.IP, error) { defer resp.Body.Close() - content, err := io.ReadAll(resp.Body) + content, err := io.ReadAll(io.LimitReader(resp.Body, MaxRespBodyLength)) if err != nil { return nil, err } diff --git a/pkg/webhook/interpreter/http.go b/pkg/webhook/interpreter/http.go index 1c4a27981..6d2afc564 100644 --- a/pkg/webhook/interpreter/http.go +++ b/pkg/webhook/interpreter/http.go @@ -14,6 +14,11 @@ import ( configv1alpha1 "github.com/karmada-io/karmada/pkg/apis/config/v1alpha1" ) +const ( + // MaxRespBodyLength is the max length of http response body + MaxRespBodyLength = 1 << 20 // 1 MiB +) + var admissionScheme = runtime.NewScheme() var admissionCodecs = serializer.NewCodecFactory(admissionScheme) @@ -33,7 +38,7 @@ func (wh *Webhook) ServeHTTP(w http.ResponseWriter, r *http.Request) { } defer r.Body.Close() - if body, err = io.ReadAll(r.Body); err != nil { + if body, err = io.ReadAll(io.LimitReader(r.Body, MaxRespBodyLength)); err != nil { klog.Errorf("unable to read the body from the incoming request: %w", err) res = Errored(http.StatusBadRequest, err) wh.writeResponse(w, res)