modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

oauthex: bound dcr read to 1mb (#1206)

Browse source
This commit is contained in:
Yaroslav 2026-08-28 09:43:05 +02:00 • committed by GitHub
commit 5a89b63764
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
oauthex/dcr.go
View file

@ -175,6 +175,10 @@ func (e *ClientRegistrationError) Error() string {
return fmt.Sprintf("registration failed: %s (%s)", e.ErrorCode, e.ErrorDescription)
}
// maxRegistrationResponseBytes bounds the dynamic client registration response
// body read from the authorization server.
const maxRegistrationResponseBytes = 1 << 20 // 1 MiB
// RegisterClient performs Dynamic Client Registration according to RFC 7591.
func RegisterClient(ctx context.Context, registrationEndpoint string, clientMeta *ClientRegistrationMetadata, c *http.Client) (*ClientRegistrationResponse, error) {
if registrationEndpoint == "" {
@ -204,7 +208,7 @@ func RegisterClient(ctx context.Context, registrationEndpoint string, clientMeta
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
body, err := io.ReadAll(io.LimitReader(resp.Body, maxRegistrationResponseBytes))
if err != nil {
return nil, fmt.Errorf("failed to read registration response body: %w", err)
}