fix(net): stream safeFetch body with incremental maxSize enforcement#487
fix(net): stream safeFetch body with incremental maxSize enforcement#487HiddenPuppy wants to merge 2 commits intomainfrom
Conversation
safeFetch runs SSRF guards (HTTPS-only check + assertNotPrivateHost) against the initial URL, but Electron's net.fetch follows HTTP redirects (3xx) by default without re-running any checks. An attacker-controlled endpoint can respond with 302 Location: http://127.0.0.1/admin to bypass the SSRF guard entirely. Fix: pass redirect:'error' to net.fetch so any 3xx response throws immediately instead of being followed. Closes #406
safeFetch enforces maxSize after await res.arrayBuffer() has already buffered the entire response body in memory. A malicious server can omit or lie about content-length and stream an endless body, causing the main process to OOM the entire Electron app. Switch to a streaming reader (res.body.getReader()) that accumulates chunks and aborts as soon as the accumulated byte count exceeds maxSize. The content-length pre-check is kept as a cheap short-circuit for well-behaved servers. Closes #408
|
Hi @HiddenPuppy, DetailsInstructions for interacting with me using comments are available here. |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request improves the security and memory efficiency of the safeFetch utility. By switching from buffered to streaming response handling, the application is now protected against malicious servers that could cause out-of-memory crashes by streaming data beyond the configured size limits. Additionally, it tightens network security by explicitly disabling automatic redirects. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors safeFetch to use a streaming approach for reading response bodies, enabling incremental size enforcement and improving security by disabling redirects. Review feedback suggests handling null response bodies gracefully to maintain compatibility with the previous implementation and optimizing the buffer concatenation process by providing the total length and removing unnecessary mappings.
| const reader = res.body?.getReader(); | ||
| if (!reader) throw new Error('no body'); |
There was a problem hiding this comment.
The current implementation throws an error if res.body is null (e.g., for a 204 No Content response). The previous implementation using res.arrayBuffer() would return an empty buffer in such cases. To maintain compatibility and handle body-less responses gracefully, consider returning an empty buffer instead of throwing.
| const reader = res.body?.getReader(); | |
| if (!reader) throw new Error('no body'); | |
| if (!res.body) return Buffer.alloc(0); | |
| const reader = res.body.getReader(); |
| } | ||
| chunks.push(value); | ||
| } | ||
| return Buffer.concat(chunks.map((c) => Buffer.from(c))); |
There was a problem hiding this comment.
Buffer.concat accepts an array of Uint8Array directly, so mapping chunks to Buffer instances is unnecessary. Additionally, since the total length is already tracked in the total variable, providing it to Buffer.concat avoids an extra iteration to calculate the length.
| return Buffer.concat(chunks.map((c) => Buffer.from(c))); | |
| return Buffer.concat(chunks, total); |
1 participant
Problem
safeFetchenforcesmaxSizeafterawait res.arrayBuffer()has already buffered the entire response body into memory. A malicious server can omit or lie aboutcontent-lengthand stream an endless body, causing the main process to consume gigabytes of memory and OOM crash the entire Electron app.Fix
Replace
res.arrayBuffer()with a streaming reader (res.body.getReader()) that accumulates chunks incrementally and aborts the fetch as soon as the accumulated byte count exceedsmaxSize. Thecontent-lengthheader pre-check is kept as a cheap short-circuit for well-behaved servers.Verification
pnpm checkpasses (49 test files, 311 tests)Closes #408