Skip to content

fix(android): limit imported profile payloads#30

Closed
AmirrezaFarnamTaheri wants to merge 1 commit into
Hidden-Node:mainfrom
AmirrezaFarnamTaheri:android-import-payload-limits
Closed

fix(android): limit imported profile payloads#30
AmirrezaFarnamTaheri wants to merge 1 commit into
Hidden-Node:mainfrom
AmirrezaFarnamTaheri:android-import-payload-limits

Conversation

@AmirrezaFarnamTaheri
Copy link
Copy Markdown
Contributor

Summary

  • cap TOML import reads at 256 KiB before loading file contents into memory
  • cap resolver import reads at the existing resolver analyzer limit before normalization
  • skip overlong imported domains, encryption keys, and advanced values with clear too-large messages

Validation

  • git diff --check
  • gradle :app:compileDebugKotlin reaches Kotlin compilation but is blocked by the existing missing gomobile mobile package/AAR setup.

@Hidden-Node
Copy link
Copy Markdown
Owner

Thank you for the effort in implementing these payload limits. However, I’ve decided not to merge this PR at this time.

The main reason is that some advanced users may want to import and scan very large lists of DNS resolvers. Setting a strict 256 KB limit could prevent them from importing comprehensive lists for scanning, which is a key feature of the app. While I agree that stability is important, I believe that for this specific project, the flexibility of importing large datasets outweighs the risks of memory exhaustion from malformed files.

I’ll keep the idea of payload limits in mind for future optimizations, perhaps with a much higher ceiling or a different approach to handling large files. Thanks again for your contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants