| 1 |
# A raw `Response::json`/`text`/`bytes` reads the whole body with no size limit, |
| 2 |
# so a hostile or buggy server can stream an arbitrarily large body and OOM the |
| 3 |
# client (worst case: the public, unauthenticated OTA updater check). Every body |
| 4 |
# read must go through `client::helpers::read_body_capped` (or its `read_json_capped` |
| 5 |
# / `read_text_capped` wrappers), which drains `bytes_stream()` under a hard cap. |
| 6 |
# `blob_download` streams `bytes_stream()` directly under its own 4 GiB cap. |
| 7 |
# This seal makes a new uncapped read a compile-time (clippy) error, not a latent |
| 8 |
# OOM lever someone has to remember to avoid. |
| 9 |
disallowed-methods = [ |
| 10 |
{ path = "reqwest::Response::json", reason = "unbounded body read; use client::helpers::read_json_capped" }, |
| 11 |
{ path = "reqwest::Response::text", reason = "unbounded body read; use client::helpers::read_text_capped" }, |
| 12 |
{ path = "reqwest::Response::bytes", reason = "unbounded body read; use client::helpers::read_body_capped (or bytes_stream() under an explicit cap)" }, |
| 13 |
] |
| 14 |
|