Limit maximum response size

[kornelski]

Superagent buffers and uncompresses responses in memory. Malicious server could send extremely large response causing superagent to use excessive amounts of memory.

I suggest adding a way to set a maximum response size, and have a default limit set.

[letsgolesco]

Heads up, this is blocking my company's CI builds - would appreciate a speedy fix if it's possible.

Edit: see https://nodesecurity.io/advisories/479

[kornelski]

Could you help by making a pull request?

[walshie4]

I'm in to help, breaking our builds as well (for the time being @letsgolesco you can use a .nsprc file to ignore this advisory). I'll report back with any progress.

[westy92]

To ignore for now, add the following to an .nsprc file:

{
  "exceptions": ["https://nodesecurity.io/advisories/479"]
}

[kornelski]

Fixed in v3.7.0

[edmorley]

This is still showing on https://nodesecurity.io/advisories/479 as not fixed, so I've dropped them an email to update the advisory :-)

[chrisfosterelli]

It's updated now 🎉

[ir-fuel]

Can someone point me to where it is explained how to set a maximum response size? I would like to download more than 200MB, but I can't find how to specify a bigger number.

[Enet4]

In case someone stumbles upon this issue, the maximum response size can be changed via the method maxResponseSize.

superagent.get(url)
    .maxResponseSize(4000000000)