fix: measure GBFS response cap in bytes, not string length (#45)

* fix: measure GBFS response cap in bytes, not string length

The 5 MB cap compared GBFS_MAX_BODY_BYTES against body.length, which is the
string's UTF-16 code-unit count rather than its byte size. Those match for
ASCII but diverge for multi-byte payloads, so a large non-ASCII response
could slip past the cap. Switched to Buffer.byteLength.

Closes #32

* docs(changelog): move the GBFS byte-cap entry into the current Unreleased section

---------

Co-authored-by: Bilawal Sidhu <[email protected]>
Co-authored-by: Bilawal Sidhu <[email protected]>
This commit is contained in:
authored and GitHub committed 2026-08-31 18:55:17 -05:00
1 parent 6b7bca2913
commit 9db0813daf
2 files changed
+8 -1

No files matched your search

+1 -1
View File
@@ -3373,7 +3373,7 @@ function gbfsProxy() {
return;
}
const body = await upstream.text();
if (body.length > GBFS_MAX_BODY_BYTES) {
if (Buffer.byteLength(body, 'utf8') > GBFS_MAX_BODY_BYTES) {
res.writeHead(502, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
res.end(JSON.stringify({ error: 'GBFS upstream response too large' }));
return;