Skip to content

fix(fetchers): enforce max_body_size in GitHub issue fetcher#121

Merged
chaliy merged 2 commits into
mainfrom
2026-05-17-fix-github-issue-fetcher-size-bypass
May 17, 2026
Merged

fix(fetchers): enforce max_body_size in GitHub issue fetcher#121
chaliy merged 2 commits into
mainfrom
2026-05-17-fix-github-issue-fetcher-size-bypass

Conversation

@chaliy
Copy link
Copy Markdown
Contributor

@chaliy chaliy commented May 17, 2026

Motivation

  • Close a size-limit bypass where GitHubIssueFetcher consumed GitHub API JSON with unbounded json() and returned full issue and comment bodies, ignoring FetchOptions.max_body_size and FetchResponse.truncated.

Description

  • Apply FetchOptions.max_body_size (with a 5 MiB fallback) to the formatted GitHub issue/PR markdown before returning it via the fetcher by truncating the output to the configured cap.
  • Add a UTF-8-safe truncation helper truncate_to_max_bytes to avoid splitting multibyte characters when trimming output.
  • Populate FetchResponse.size and FetchResponse.truncated to reflect the returned content length and whether truncation occurred.
  • Add unit test coverage for the truncation helper (including multibyte boundary behavior) and keep existing formatting/fetch behavior intact.

Testing

  • Ran formatter: cargo fmt --all (completed successfully).
  • Ran targeted tests: cargo test -p fetchkit github_issue -- --nocapture, and the fetcher tests passed (11 passed; 0 failed).
  • All modified-unit tests covering truncation and formatting succeeded.

Codex Task

@chaliy chaliy merged commit 0da159e into main May 17, 2026
11 checks passed
@chaliy chaliy deleted the 2026-05-17-fix-github-issue-fetcher-size-bypass branch May 17, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant