mirror of
https://github.com/stablyai/orca.git
synced 2026-10-23 00:03:52 +00:00
NeilandOrca
06937af61a
requestGitStreamable trusted the relay's declared size: every chunk was pushed into `parts`, then Buffer.concat'd and JSON.parse'd with no ceiling. A buggy or hostile relay could name any totalBytes and the host would allocate it. The file path already had this gate — ssh-filesystem-stream-reader checks the declared totalSize against a cap before accepting a stream. #14160 added a read cap for files only; this closes the same hole for git. Rejects at the marker, before a single chunk transfers, and cancels the stream so the relay stops sending instead of us draining a payload we already refused. The cap is 32 MiB, above anything a legitimate diff can produce: the relay caps each git exec at MAX_GIT_BUFFER (10 MiB), so two blobs base64-inflated top out near 27 MiB. So no diff that works today starts failing. Test: mutation-verified — disabling the gate hangs the over-cap case until the inactivity timeout instead of rejecting. 7471 tests pass across ssh, providers, runtime and relay; node and cli typechecks clean. Co-authored-by: Orca <help@stably.ai>