无界体读取会导致内存和磁盘耗尽
作者: Ray0x01创建于 2026年4月27日更新于 2026年4月27日
1. Request logging reads full request bodies into memory
In the request logging middleware:
if req.Body != nil {
// TODO: Use io.LimitReader.
var err error
body, err = ioutil.ReadAll(req.Body)
if err != nil {
...
}
req.Body = ioutil.NopCloser(bytes.NewBuffer(body))
clone.Body = ioutil.NopCloser(bytes.NewBuffer(body))
}- reqlog.go This reads the entire request body into memory without bounds.
2. Response logging reads full response bodies into memory
In response logging:
if res.Body != nil {
// TODO: Use io.LimitReader.
body, err := io.ReadAll(res.Body)
if err != nil {
return fmt.Errorf("reqlog: could not read response body: %w", err)
}
res.Body = io.NopCloser(bytes.NewBuffer(body))
clone.Body = io.NopCloser(bytes.NewBuffer(body))
}- reqlog.go The full response body is buffered in memory and then passed to background storage.
3. Stored response bodies are read again without limits
func ParseHTTPResponse(res *http.Response) (ResponseLog, error) {
body, err := io.ReadAll(res.Body)
if err != nil {
return ResponseLog{}, fmt.Errorf("reqlog: could not read body: %w", err)
}
return ResponseLog{
Proto: res.Proto,
StatusCode: res.StatusCode,
Body: body,
}
}内容来源: dstotijn/hetty