naps62-yoloandClaude Opus 4.8
b0774934e8
ci / rust (push) Successful in 6m56s
`proxy_http` buffered request bodies with `to_bytes(.., usize::MAX)` and materialized full upstream responses with `.bytes()`. Anyone reachable on the bind address could POST a multi-GB body (the cookie middleware admits any signed cookie) and OOM the process; a large upstream reply did the same. Cap buffered request bodies at 8 MiB and return 413 on overflow; stream the upstream response straight through via `bytes_stream()` → `Body::from_stream` so it's never fully held in RAM. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>