From 188d9fc02fcfe33c01f9481e369778a3f98f254c Mon Sep 17 00:00:00 2001 From: claude Date: Thu, 6 Aug 2026 02:26:42 +0400 Subject: [PATCH] mavcaldav: name the shared response-body read cap (V-581) fetchEvents and listPublished both bounded their HTTP body reads at 4<<20 with no name for what the number was for. One constant, maxResponseBody, documents the reason (cap every CalDAV response this daemon reads) once instead of twice. No functional change. --- cmd/mavcaldav/main.go | 7 ++++++- cmd/mavcaldav/render.go | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/cmd/mavcaldav/main.go b/cmd/mavcaldav/main.go index 4c120bd..c59fa3b 100644 --- a/cmd/mavcaldav/main.go +++ b/cmd/mavcaldav/main.go @@ -188,6 +188,11 @@ func (p *poller) pollOnce(ctx context.Context) { } } +// maxResponseBody bounds every CalDAV response this daemon reads (the poller's +// GET and the renderer's PROPFIND) — a misbehaving or malicious server gets a +// truncated read, not an unbounded one. +const maxResponseBody = 4 << 20 + // fetchEvents GETs the calendar URL and parses VEVENTs from the iCal response. func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Event, error) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.url, nil) @@ -203,7 +208,7 @@ func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Eve } defer resp.Body.Close() - body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20)) + body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody)) if err != nil { return nil, err } diff --git a/cmd/mavcaldav/render.go b/cmd/mavcaldav/render.go index 4568317..b85b319 100644 --- a/cmd/mavcaldav/render.go +++ b/cmd/mavcaldav/render.go @@ -142,7 +142,7 @@ func (r *renderer) listPublished(ctx context.Context) ([]int64, error) { return nil, err } defer resp.Body.Close() - raw, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20)) + raw, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody)) if err != nil { return nil, err }