Skip to content

🐛 bug: reject oversized unknown-length adaptor request bodies#4306

Merged
ReneWerner87 merged 3 commits into
mainfrom
fix-fibre-adaptor-silent-truncation-issue
May 21, 2026
Merged

🐛 bug: reject oversized unknown-length adaptor request bodies#4306
ReneWerner87 merged 3 commits into
mainfrom
fix-fibre-adaptor-silent-truncation-issue

Conversation

@gaby

@gaby gaby commented May 21, 2026

Copy link
Copy Markdown
Member

Motivation

  • The net/http -> Fiber adaptor was silently truncating unknown-length (e.g., chunked) request bodies to the app BodyLimit and processing the truncated payload instead of rejecting oversized requests.
  • This could allow an attacker to send >BodyLimit data with no Content-Length and bypass application-level validation or corrupt uploads.

Description

  • Read up to BodyLimit+1 bytes from the incoming r.Body in handlerFunc, allowing detection of truncation when the declared length is unknown by using io.LimitReader(r.Body, maxBodySize+1) and io.Copy.
  • Return HTTP 413 (StatusRequestEntityTooLarge) when the copied byte count exceeds the configured BodyLimit before setting the fasthttp Content-Length header.
  • Preserve the existing early reject behavior for requests that declare a Content-Length larger than the configured limit.
  • Add an adaptor test case in Test_FiberHandler_BodyLimit that submits an over-limit payload with ContentLength = -1 (unknown-length) and asserts the handler returns 413.

@gaby gaby requested a review from a team as a code owner May 21, 2026 11:31
Copilot AI review requested due to automatic review settings May 21, 2026 11:31
@gaby gaby requested review from ReneWerner87, efectn and sixcolors and removed request for Copilot May 21, 2026 11:31
@coderabbitai

coderabbitai Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 0d61f468-5722-45a4-9e86-b980c7f63b60

📥 Commits

Reviewing files that changed from the base of the PR and between 5842f01 and b67853e.

📒 Files selected for processing (1)
  • middleware/adaptor/adaptor.go

Walkthrough

The PR updates the net/http-to-fasthttp adaptor middleware to reliably detect oversized request bodies. The implementation now uses io.LimitReader sized to maxBodySize+1 to allow detection of overflow during copying, validates that copied bytes do not exceed maxBodySize, and returns HTTP 413 when exceeded. Test coverage is expanded to include scenarios with unknown content length.

Changes

Body Size Limit Detection

Layer / File(s) Summary
Implementation: post-copy overflow detection
middleware/adaptor/adaptor.go
Request body reading now wraps the net/http body with an io.LimitReader capped at maxBodySize+1 (using overflow-safe math), copies with io.Copy, checks copied bytes and returns 413 when n > maxBodySize, and sets fasthttp Content-Length only after validation.
Tests: unknown ContentLength and exceeded-body case
middleware/adaptor/adaptor_test.go
Adds an unknownLength boolean to Test_FiberHandler_BodyLimit, a new case verifying 413 when the body exceeds the limit with ContentLength == -1, and request construction that sets req.ContentLength to -1 for unknown-length cases.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

  • gofiber/fiber#3770: Both PRs modify middleware/adaptor/adaptor.go's request body size limiting logic to return 413 when the body exceeds the max size.
  • gofiber/fiber#3990: Both PRs enforce the adaptor's request-body size limit and add test coverage for 413 behavior when the configured limit is exceeded.

Suggested reviewers

  • sixcolors
  • efectn

Poem

🐰 I nibble bytes with careful art,
Not counting length by just the start,
A LimitReader keeps watch for me,
When extras creep—413!
Hooray, the adaptor's safe and smart!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main bug fix: rejecting oversized unknown-length request bodies in the adaptor, which directly matches the core change in the changeset.
Description check ✅ Passed The description provides clear motivation, detailed implementation steps, and test coverage, though it omits optional template sections like benchmarks and documentation updates.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix-fibre-adaptor-silent-truncation-issue

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@ReneWerner87 ReneWerner87 added this to v3 May 21, 2026
@ReneWerner87 ReneWerner87 added this to the v3 milestone May 21, 2026
@codecov

codecov Bot commented May 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.35%. Comparing base (0041045) to head (b67853e).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4306      +/-   ##
==========================================
+ Coverage   91.32%   91.35%   +0.02%     
==========================================
  Files         132      132              
  Lines       12941    12983      +42     
==========================================
+ Hits        11819    11861      +42     
  Misses        708      708              
  Partials      414      414              
Flag Coverage Δ
unittests 91.35% <100.00%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request enhances the adaptor middleware to correctly enforce body size limits when the content length is unknown. It updates the reading logic to use a slightly larger limit and explicitly checks if the bytes read exceed the maximum allowed size, returning a 413 Request Entity Too Large status if necessary. A review comment identifies a potential integer overflow in the limit calculation and suggests a safer initialization pattern.

Comment thread middleware/adaptor/adaptor.go Outdated

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.

Benchmark suite Current: 5842f01 Previous: 0041045 Ratio
Benchmark_SetLogger (github.com/gofiber/fiber/v3/log) 4.817 ns/op 0 B/op 0 allocs/op 3.179 ns/op 0 B/op 0 allocs/op 1.52
Benchmark_SetLogger (github.com/gofiber/fiber/v3/log) - ns/op 4.817 ns/op 3.179 ns/op 1.52

This comment was automatically generated by workflow using github-action-benchmark.

Cap the LimitReader limit at math.MaxInt64 so a BodyLimit of
math.MaxInt64 does not overflow to a negative value (which
io.LimitReader treats as 0, returning EOF immediately).

Addresses review feedback on #4306.
Copilot AI review requested due to automatic review settings May 21, 2026 11:45

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request fixes a security/validation gap in the net/http → Fiber adaptor where request bodies with unknown length (e.g., chunked, ContentLength = -1) could previously be truncated to BodyLimit and still processed, rather than being rejected as oversized.

Changes:

  • Read request bodies with io.LimitReader(..., BodyLimit+1) so the adaptor can detect when an unknown-length body exceeds BodyLimit.
  • Return HTTP 413 as soon as the copied byte count exceeds BodyLimit, before setting the fasthttp Content-Length.
  • Add a regression test ensuring unknown-length over-limit bodies are rejected with 413.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
middleware/adaptor/adaptor.go Detects oversized unknown-length request bodies by reading up to BodyLimit+1 and rejecting when exceeded.
middleware/adaptor/adaptor_test.go Adds a test case covering unknown-length (ContentLength = -1) over-limit request bodies returning 413.

@ReneWerner87 ReneWerner87 merged commit 6a97fe8 into main May 21, 2026
25 checks passed
@ReneWerner87 ReneWerner87 deleted the fix-fibre-adaptor-silent-truncation-issue branch May 21, 2026 11:58
@github-project-automation github-project-automation Bot moved this to Done in v3 May 21, 2026
@ReneWerner87 ReneWerner87 modified the milestones: v3, v3.3.0 May 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants