liuyu/nofx
1
0
Fork 0
mirror of https://github.com/NoFxAiOS/nofx.git synced 2026-07-12 07:16:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

security: add safe.ReadAllLimited — bound all HTTP response body reads to 10MB

Browse Source 
- Created safe/io.go with ReadAllLimited helper (default 10MB limit)
- Replaced 62 unbounded io.ReadAll(resp.Body) calls across 32 files
- Covers all exchange traders (Hyperliquid, Bybit, Binance, OKX, Aster,
  KuCoin, Gate, Bitget, Lighter, Indodax), providers (CoinAnk, Alpaca,
  TwelveData), MCP client/x402, market data, wallet, telegram, kernel
- Prevents OOM from malicious/buggy exchange API responses
- Previously fixed: brain.go, sentinel.go already had manual LimitReader
This commit is contained in:
shinchan-zhai
2026-03-23 10:55:03 +08:00
parent 1d0d6f7afd
commit 982ee668c9
33 changed files with 120 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
provider/alpaca/kline.go
View File

@@ -1,10 +1,10 @@
package alpaca
import (
"nofx/safe"
"context"
"encoding/json"
"fmt"
"io"
"net/http"
"net/url"
"nofx/config"
@@ -111,7 +111,7 @@ func (c *Client) GetBars(ctx context.Context, symbol string, timeframe string, l
defer resp.Body.Close()
// Read response
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return nil, fmt.Errorf("failed to read response: %w", err)
}

4
provider/coinank/coinank_api/kline.go
View File

@@ -1,10 +1,10 @@
package coinank_api
import (
"nofx/safe"
"context"
"encoding/json"
"fmt"
"io"
"net/http"
"net/url"
"nofx/provider/coinank"
@@ -67,7 +67,7 @@ func get(ctx context.Context, path string, paramsMap map[string]string) (string,
return "", err
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return "", err
}

6
provider/coinank/coinank_http.go
View File

@@ -1,12 +1,12 @@
package coinank
import (
"nofx/safe"
"bytes"
"context"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"net/url"
"time"
@@ -59,7 +59,7 @@ func (c *CoinankClient) Get(ctx context.Context, path string, paramsMap map[stri
return "", err
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return "", err
}
@@ -84,7 +84,7 @@ func (c *CoinankClient) Post(ctx context.Context, path string, data any) (string
return "", err
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return "", err
}

8
provider/hyperliquid/kline.go
View File

@@ -1,11 +1,11 @@
package hyperliquid
import (
"nofx/safe"
"bytes"
"context"
"encoding/json"
"fmt"
"io"
"net/http"
"strings"
"time"
@@ -117,7 +117,7 @@ func (c *Client) GetCandles(ctx context.Context, coin string, interval string, l
defer resp.Body.Close()
// Read response
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return nil, fmt.Errorf("failed to read response: %w", err)
}
@@ -169,7 +169,7 @@ func (c *Client) GetAllMidsWithDex(ctx context.Context, dex string) (map[string]
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return nil, fmt.Errorf("failed to read response: %w", err)
}
@@ -206,7 +206,7 @@ func (c *Client) GetMeta(ctx context.Context) (*Meta, error) {
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return nil, fmt.Errorf("failed to read response: %w", err)
}

6
provider/twelvedata/kline.go
View File

@@ -1,10 +1,10 @@
package twelvedata
import (
"nofx/safe"
"context"
"encoding/json"
"fmt"
"io"
"net/http"
"net/url"
"nofx/config"
@@ -125,7 +125,7 @@ func (c *Client) GetTimeSeries(ctx context.Context, symbol string, interval stri
defer resp.Body.Close()
// Read response
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return nil, fmt.Errorf("failed to read response: %w", err)
}
@@ -172,7 +172,7 @@ func (c *Client) GetQuote(ctx context.Context, symbol string) (*QuoteResponse, e
defer resp.Body.Close()
// Read response
body, err := io.ReadAll(resp.Body)
body, err := safe.ReadAllLimited(resp.Body)
if err != nil {
return nil, fmt.Errorf("failed to read response: %w", err)
}