benmichael/gods-eye-view
1
0 Fork 0
mirror of https://github.com/bilawalsidhu/gods-eye-view.git synced 2026-11-04 10:24:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: measure GBFS response cap in bytes, not string length (#45)

Browse Source 
* fix: measure GBFS response cap in bytes, not string length

The 5 MB cap compared GBFS_MAX_BODY_BYTES against body.length, which is the
string's UTF-16 code-unit count rather than its byte size. Those match for
ASCII but diverge for multi-byte payloads, so a large non-ASCII response
could slip past the cap. Switched to Buffer.byteLength.

Closes #32

* docs(changelog): move the GBFS byte-cap entry into the current Unreleased section

---------

Co-authored-by: Bilawal Sidhu <[email protected]>
Co-authored-by: Bilawal Sidhu <[email protected]>
This commit is contained in:
Prajwal RajBilawal SidhuBilawal Sidhu
 authored and GitHub committed 2026-08-31 18:55:17 -05:00
1 parent 6b7bca2913
commit 9db0813daf
2 files changed
+8 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+7
View File
@@ -13,6 +13,13 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
global detections while reporting each dropped source twice, once as global detections while reporting each dropped source twice, once as
successful with its real count and once as failed. successful with its real count and once as failed.
### Security
- GBFS proxy body-size cap now measures the response in bytes
(`Buffer.byteLength`) instead of JavaScript string length, so the
`GBFS_MAX_BODY_BYTES` limit holds for multi-byte payloads and cannot be
overrun by non-ASCII upstream responses.
## [0.1.0] — 2026-08-31 — One-click install, keyless boot, Provider Settings ## [0.1.0] — 2026-08-31 — One-click install, keyless boot, Provider Settings
### Added ### Added
vite.config.js
+1 -1
View File
@@ -3373,7 +3373,7 @@ function gbfsProxy() {
return; return;
} }
const body = await upstream.text(); const body = await upstream.text();
if (body.length > GBFS_MAX_BODY_BYTES) { if (Buffer.byteLength(body, 'utf8') > GBFS_MAX_BODY_BYTES) {
res.writeHead(502, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.writeHead(502, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
res.end(JSON.stringify({ error: 'GBFS upstream response too large' })); res.end(JSON.stringify({ error: 'GBFS upstream response too large' }));
return; return;