Unbounded io.ReadAll for messages and attachments ai:claude-sonnet-5-5 #51

New issue

Open

opened 2026-10-24 09:14:32 +02:00 by heiko · 0 comments

heiko commented

2026-10-24 09:14:32 +02:00

Owner

Priority: minor

Found by a 100 Go Mistakes review (resource limits). Verified by reading the code.

Where: internal/scanner/scanner.go:175, internal/scanner/attachment.go:79, internal/xrechnung/pdf.go:75

Problem: The full RFC822 body and each invoice-like attachment is read into memory without a size cap, so a very large message can exhaust the daemon's memory.

Fix: Wrap with io.LimitReader and a configurable maximum; skip and log oversize messages.

(co)authored by ai:claude-sonnet-5-5

**Priority: minor** Found by a 100 Go Mistakes review (resource limits). Verified by reading the code. **Where:** `internal/scanner/scanner.go:175`, `internal/scanner/attachment.go:79`, `internal/xrechnung/pdf.go:75` **Problem:** The full RFC822 body and each invoice-like attachment is read into memory without a size cap, so a very large message can exhaust the daemon's memory. **Fix:** Wrap with `io.LimitReader` and a configurable maximum; skip and log oversize messages. (co)authored by ai:claude-sonnet-5-5