Identified during review of PR #90 (Gitea adapter phase 2). Both the security-review-bot and self-review flagged this.
Problem
In gitea/adapter.go, PostReview calls GetPullRequestDiff without any size guard when translating comment positions. For very large PRs, this fetches the full diff into memory unconditionally, which could cause elevated memory/CPU usage (potential DoS vector).
Suggested Approach
Add a configurable max-diff-size threshold (e.g., 10 MB)
Return a clear error if the diff exceeds the threshold, skipping position translation
Alternatively, stream/limit reads in the HTTP client for successful GET responses
Consider Content-Length checking before reading the body
Acceptance Criteria
PostReview respects a maximum diff size
Clear error returned when diff exceeds limit
Test covering the size-exceeded path
## Context
Identified during review of PR #90 (Gitea adapter phase 2). Both the security-review-bot and self-review flagged this.
## Problem
In `gitea/adapter.go`, `PostReview` calls `GetPullRequestDiff` without any size guard when translating comment positions. For very large PRs, this fetches the full diff into memory unconditionally, which could cause elevated memory/CPU usage (potential DoS vector).
## Suggested Approach
- Add a configurable max-diff-size threshold (e.g., 10 MB)
- Return a clear error if the diff exceeds the threshold, skipping position translation
- Alternatively, stream/limit reads in the HTTP client for successful GET responses
- Consider `Content-Length` checking before reading the body
## Acceptance Criteria
- [ ] `PostReview` respects a maximum diff size
- [ ] Clear error returned when diff exceeds limit
- [ ] Test covering the size-exceeded path
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Context
Identified during review of PR #90 (Gitea adapter phase 2). Both the security-review-bot and self-review flagged this.
Problem
In
gitea/adapter.go,PostReviewcallsGetPullRequestDiffwithout any size guard when translating comment positions. For very large PRs, this fetches the full diff into memory unconditionally, which could cause elevated memory/CPU usage (potential DoS vector).Suggested Approach
Content-Lengthchecking before reading the bodyAcceptance Criteria
PostReviewrespects a maximum diff size