From fed7752b69de182401cc3560257ae03ac26b48c9 Mon Sep 17 00:00:00 2001 From: Yaroslav Shevchuk Date: Fri, 28 Aug 2026 07:01:51 +0000 Subject: [PATCH] bound dcr read to 1mb --- oauthex/dcr.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/oauthex/dcr.go b/oauthex/dcr.go index f46d0e8e..f95c55bb 100644 --- a/oauthex/dcr.go +++ b/oauthex/dcr.go @@ -175,6 +175,10 @@ func (e *ClientRegistrationError) Error() string { return fmt.Sprintf("registration failed: %s (%s)", e.ErrorCode, e.ErrorDescription) } +// maxRegistrationResponseBytes bounds the dynamic client registration response +// body read from the authorization server. +const maxRegistrationResponseBytes = 1 << 20 // 1 MiB + // RegisterClient performs Dynamic Client Registration according to RFC 7591. func RegisterClient(ctx context.Context, registrationEndpoint string, clientMeta *ClientRegistrationMetadata, c *http.Client) (*ClientRegistrationResponse, error) { if registrationEndpoint == "" { @@ -204,7 +208,7 @@ func RegisterClient(ctx context.Context, registrationEndpoint string, clientMeta } defer resp.Body.Close() - body, err := io.ReadAll(resp.Body) + body, err := io.ReadAll(io.LimitReader(resp.Body, maxRegistrationResponseBytes)) if err != nil { return nil, fmt.Errorf("failed to read registration response body: %w", err) }