Skip to content

security fixes (fixed) - #2

Open
micfogas wants to merge 4 commits into
l3utterfly:mainfrom
micfogas:main
Open

micfogas wants to merge 4 commits into
l3utterfly:mainfrom
micfogas:main

Conversation

@micfogas

Copy link
Copy Markdown

patch 1: Added MAX_BUFFER_SIZE limit (2MB) inside chunk ingestion to prevent buffer bloat and OOM denial-of-service risks.
patch 2: Migrated payload assembly from a single global bufferedRequestRef to a Map (requestBuffersRef), isolating streams
by sessionId to prevent data corruption during multi-tenant or overlapping requests.
patch 3: Bound streamAbortControllerRef.current.abort() directly to DataChannel onclose and PeerConnection failure states to
halt orphaned local inferences automatically upon disconnect.
patch 4: Wrapped the fully assembled payload in a JSON.parse() verification block on the "end" phase. Corrupted payloads now
return an explicit error string over WebRTC rather than forwarding malformed POSTs to the local server.

added forgotten ? for dc. calls

  • added forgotten ? for dc. calls

micfogas added 4 commits June 14, 2026 13:42
…prevent buffer bloat and OOM denial-of-service risks.

patch 2: Migrated payload assembly from a single global bufferedRequestRef to a Map (requestBuffersRef), isolating streams
	by sessionId to prevent data corruption during multi-tenant or overlapping requests.
patch 3: Bound streamAbortControllerRef.current.abort() directly to DataChannel onclose and PeerConnection failure states to
	halt orphaned local inferences automatically upon disconnect.
patch 4: Wrapped the fully assembled payload in a JSON.parse() verification block on the "end" phase. Corrupted payloads now
	return an explicit error string over WebRTC rather than forwarding malformed POSTs to the local server.

Signed-off-by: micfogas <micfogas@technotic.us>
Signed-off-by: micfogas <micfogas@technotic.us>
Signed-off-by: micfogas <micfogas@technotic.us>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant