Skip to content

Limit response sizes from query-frontends - #13829

Closed
charleskorn wants to merge 7 commits into
mainfrom
charleskorn/limit-frontend-response-size
Closed

Limit response sizes from query-frontends#13829
charleskorn wants to merge 7 commits into
mainfrom
charleskorn/limit-frontend-response-size

Add changelog entry, and add flag to `about-versioning.md`.

9e702fe
Select commit
Loading
Failed to load commit list.
Cursor / Cursor Bugbot completed Dec 15, 2025 in 7m 11s

Bugbot Review

Bugbot Analysis Progress (7m 14s elapsed)

✅ Gathered PR context (3s)
✅ Analyzed code changes (1s)
✅ Completed bug detection — 3 potential bugs found (6m 59s)
✅ Validation and filtering completed (1s)
✅ Posted analysis results — 3 bugs reported (11s)
✅ Analysis completed successfully (0s)

Final Result: Bugbot completed review and found 3 potential issues

Request ID: serverGenReqId_6ad21484-8863-4882-8f30-4f26bd71cf3f

Details

Bug: Missing limit check in WriteUint16 early return path

In the forked json-iterator library, WriteUint16 is missing an enforceMaxBytes() call on its early return path when the value is less than 1000. While WriteUint32 correctly calls enforceMaxBytes() on all return paths (lines 82, 90, 104), WriteUint16 only calls it at line 61, not at the early return on line 56. This means when marshalling uint16/int16 values less than 1000, those specific bytes bypass the limit check, potentially allowing responses to slightly exceed the configured MaxResponseSizeBytes limit before the next write operation catches it.

vendor/github.com/json-iterator/go/stream_int.go#L53-L56

q1 := val / 1000
if q1 == 0 {
stream.buf = writeFirstBuf(stream.buf, digits[val])
return

Fix in Cursor Fix in Web