From 6ef42275f8328df0d9418f0f36c21aefdc66241a Mon Sep 17 00:00:00 2001
From: Gubarz <1037896+Gubarz@users.noreply.github.com>
Date: Sat, 30 May 2026 22:47:55 -0600
Subject: [PATCH] fix(registry): cap registry fetch size to 5MB

---
 pkg/registry/registry.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkg/registry/registry.go b/pkg/registry/registry.go
index e4c98dc..cef63fb 100644
--- a/pkg/registry/registry.go
+++ b/pkg/registry/registry.go
@@ -9,11 +9,12 @@ package registry
 import (
 	"context"
 	"fmt"
-	"github.com/cheatmd-dev/cheatmd/internal/httputil"
 	"io"
 	"strings"
 	"time"
 
+	"github.com/cheatmd-dev/cheatmd/internal/httputil"
+
 	yaml "go.yaml.in/yaml/v3"
 )
 
@@ -52,7 +53,8 @@ func Fetch(ctx context.Context, url string) (*Registry, error) {
 	}
 	defer respBody.Close()
 
-	data, err := io.ReadAll(respBody)
+	// Cap registry fetch to 5MB to prevent memory exhaustion
+	data, err := io.ReadAll(io.LimitReader(respBody, 5*1024*1024))
 	if err != nil {
 		return nil, fmt.Errorf("read registry body: %w", err)
 	}