Skip to content

go-sdk: panic on malformed S2-compressed poll response #3129

@atharvalade

Description

@atharvalade

DeserializeFetchMessagesResponse in Go SDK calls panic() when S2 decompression fails, instead of returning an error.

payloadSlice, err = s2.Decode(nil, payloadSlice)
if err != nil {
    panic("iggy: failed to decode s2 payload: " + err.Error())
}

A truncated or corrupt compressed message from the server crashes the entire Go client process. This is a DoS vector clients should never panic on bad server data.

We should return error instead of calling panic.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions