[Bug] safeFetch buffers entire response before enforcing maxSize — memory DoS

[samzong]

Problem

safeFetch enforces maxSize in two places, but both checks happen after the full response body has already been materialized in memory:

1. The content-length header check is advisory — a malicious server can omit or lie about it.
2. await res.arrayBuffer() buffers the entire response body into a single ArrayBuffer before the byte-length check runs. By the time we check ab.byteLength > maxSize, the memory has already been allocated.

A malicious image URL pointing to a server that omits content-length and streams an endlessly large body causes the main process to allocate gigabytes of memory before the check fires, leading to an OOM crash of the entire Electron app.

Location

File: packages/desktop/src/main/net/safe-fetch.ts:21-27

const res = await net.fetch(url, { signal: controller.signal });
if (!res.ok) throw new Error(`fetch ${url}: ${res.status}`);
const cl = Number(res.headers.get('content-length') ?? '0');
if (cl > maxSize) throw new Error('response too large');
const ab = await res.arrayBuffer();              // ← entire body buffered here
if (ab.byteLength > maxSize) throw new Error('response too large');
return Buffer.from(ab);

Fix Approach

Switch to a streaming reader that enforces maxSize incrementally and aborts as soon as the limit is exceeded:

const reader = res.body?.getReader();
if (!reader) throw new Error('no body');
const chunks: Uint8Array[] = [];
let total = 0;
while (true) {
  const { done, value } = await reader.read();
  if (done) break;
  total += value.byteLength;
  if (total > maxSize) {
    controller.abort();
    throw new Error('response too large');
  }
  chunks.push(value);
}
return Buffer.concat(chunks.map((c) => Buffer.from(c)));

Keep the initial content-length pre-check as a cheap short-circuit for well-behaved servers.

Verification

1. Run pnpm check — must pass.
2. Unit test: mock net.fetch to return a body that streams more than maxSize bytes with no content-length header; assert safeFetch throws before allocating more than maxSize bytes.
3. Manual: point safeFetch at a test server that streams /dev/urandom; confirm memory usage stays bounded.

Context

• WG: Observability & DX (security — memory DoS)
• Priority: Medium
• Estimated effort: 1 hour

[github-actions]

Hi @samzong,
Thanks for opening an issue!
We will look into it as soon as possible.

Details

Instructions for interacting with me using comments are available here.
If you have questions or suggestions related to my behavior, please file an issue against the gh-ci-bot repository.

[snakefood3232]

The safeFetch bug buffers the entire response before checking maxSize, enabling a memory DoS. I'd fix this by implementing a streaming reader to enforce the limit incrementally and abort early. I can have a PR with the fix and a unit test ready today. I've patched similar streaming vulnerabilities in production Next.js apps.

[snakefood3232]

The arrayBuffer() call buffers the entire response before checking size, creating a memory DoS vector. I'd fix this by implementing a streaming reader that enforces maxSize incrementally and aborts immediately when exceeded. I can have a PR with the fix and a unit test ready today—I've patched similar fetch vulnerabilities in production Electron apps before.