liuyu/nofx
1
0
Fork 0
mirror of https://github.com/NoFxAiOS/nofx.git synced 2026-07-12 15:26:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

security: add safe.ReadAllLimited — bound all HTTP response body reads to 10MB

Browse Source 
- Created safe/io.go with ReadAllLimited helper (default 10MB limit)
- Replaced 62 unbounded io.ReadAll(resp.Body) calls across 32 files
- Covers all exchange traders (Hyperliquid, Bybit, Binance, OKX, Aster,
  KuCoin, Gate, Bitget, Lighter, Indodax), providers (CoinAnk, Alpaca,
  TwelveData), MCP client/x402, market data, wallet, telegram, kernel
- Prevents OOM from malicious/buggy exchange API responses
- Previously fixed: brain.go, sentinel.go already had manual LimitReader
This commit is contained in:
shinchan-zhai
2026-03-23 10:55:03 +08:00
parent 1d0d6f7afd
commit 982ee668c9
33 changed files with 120 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
trader/aster/trader.go
View File

@@ -1,12 +1,12 @@
package aster
import (
"nofx/safe"
"context"
"crypto/ecdsa"
"encoding/hex"
"encoding/json"
"fmt"
"io"
"math"
"math/big"
"net/http"
@@ -100,7 +100,7 @@ func (t *AsterTrader) getPrecision(symbol string) (SymbolPrecision, error) {
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
body, _ := safe.ReadAllLimited(resp.Body)
var info struct {
Symbols []struct {
Symbol string `json:"symbol"`
@@ -392,7 +392,7 @@ func (t *AsterTrader) doRequest(method, endpoint string, params map[string]inter
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
body, _ := safe.ReadAllLimited(resp.Body)
if resp.StatusCode != http.StatusOK {
return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
}
@@ -418,7 +418,7 @@ func (t *AsterTrader) doRequest(method, endpoint string, params map[string]inter
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
body, _ := safe.ReadAllLimited(resp.Body)
if resp.StatusCode != http.StatusOK {
return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
}

6
trader/aster/trader_account.go
View File

@@ -1,10 +1,10 @@
package aster
import (
"nofx/safe"
"encoding/json"
"errors"
"fmt"
"io"
"net/http"
"nofx/logger"
"nofx/trader/types"
@@ -109,7 +109,7 @@ func (t *AsterTrader) GetMarketPrice(symbol string) (float64, error) {
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
body, _ := safe.ReadAllLimited(resp.Body)
if resp.StatusCode != http.StatusOK {
return 0, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
}
@@ -263,7 +263,7 @@ func (t *AsterTrader) GetOrderBook(symbol string, depth int) (bids, asks [][]flo
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
body, _ := safe.ReadAllLimited(resp.Body)
if resp.StatusCode != http.StatusOK {
return nil, nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
}