mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 10:26:26 +01:00
Priya RamanandPaperclip
59b064bc3f
A denied stream (a bad token, a bad path, a denied route) answered at once, then read its body through a helper that kept every chunk in an array and built one Buffer at the end. No denial ever used that body, and the read ran outside the admission gate, so a sandbox could open many denied streams and hold up to maxBodyBytes per stream in host memory with no bound from the gate. Rename the helper to discardHttp2StreamBody and drop the chunk array: it now counts bytes to enforce the same size and time bounds, then drops each chunk at once and resolves with no value. The one caller, denyRequest, is unchanged apart from the new name, so every denial branch still discards through the same central, non-retaining path and still takes no admission-gate slot. Co-authored-by: Paperclip <noreply@paperclip.ing>