possible vulnerability

[Al1-X]

🔍 Have you checked Spicetify.app page for your issue?

• I have checked the FAQ

🔍 Is there already an issue for your problem?

• I have checked older issues, open and closed

ℹ Environment / Computer Info

Spotify for Windows (64 bit)
1.2.39.578.g0ea3f38b
Spicetify v2.36.13

📝 Description

Hello! I would like to point out a possible vulnerability issue. It is located at cli/src/utils/utils.go:74. The function io.Copy() does not limit the number of bytes that are read. This may lead, in certain cases, to uncontrolled memory and disk usage. If you agree that this is a problem, I suggest using io.CopyN().
Thank you!

https://pkg.go.dev/io#CopyN

📸 Screenshots

[rxri]

And how’s that a vulnerability if whatever is copied is hard-coded or typed into the config. Lol. Not everything is vulnerable if you use it in the way that doesn’t make it such