fix: 修复请求体过长时 reqmerge 损坏数据的 bug,新增可配置的最大请求长度#1281
fix: 修复请求体过长时 reqmerge 损坏数据的 bug,新增可配置的最大请求长度#1281She-yh wants to merge 1 commit intoavwo:masterfrom
Conversation
echopi
left a comment
There was a problem hiding this comment.
Thanks for the fix! The core bug fix (&& !interrupt) is correct and important. A few suggestions:
1. Missing input validation in set-max-req-merge-size.js
parseInt can return NaN, negative values, or absurdly large numbers. The UI only offers valid options, but the API endpoint is directly accessible. Consider clamping to the valid range:
module.exports = function(req, res) {
var size = parseInt(req.body.size, 10);
if (isNaN(size) || size < 262144) {
size = 262144;
} else if (size > 16777216) {
size = 16777216;
}
properties.set('maxReqMergeSize', size);
res.json({ ec: 0, size: properties.get('maxReqMergeSize') || DEFAULT_SIZE });
};2. getMaxReqSize() needs reconciliation with master
The current master branch already has an alternative approach using enableBigData parameter and BIG_MAX_REQ_SIZE constant. This PR's getMaxReqSize() function conflicts with that. Please rebase and reconcile with the owner's approach.
3. Default value 1024 * 1024 / 1048576 is repeated in 5 places
The default appears in init.js, set-max-req-merge-size.js, network-settings.js (×2), and req.js. Consider extracting it to a single shared constant to avoid drift.
Fixes #1278