clawbot 7144617d0e Add decompression size limit in deserializeInner() (closes #24) (#29) ...

Wrap zstd decompressor with `io.LimitReader` (256MB max) to prevent decompression bombs.

Co-authored-by: clawbot <clawbot@openclaw>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

2026-02-09 01:45:55 +01:00

4.3 KiB

Raw Blame History

View Raw