beatenevo opened a new pull request, #1167:
URL: https://github.com/apache/incubator-seata-go/pull/1167

   <!--  Thanks for sending a pull request!
   -->
   <!-- Please make sure you have read and understood the contributing 
guidelines -->
   
   - [x] I have registered the PR 
[changes](https://github.com/apache/incubator-seata-go/tree/master/changes).
   
   **What this PR does**:
   Fixes a TCC Resource Manager panic when malformed `applicationData` is 
received during branch commit or rollback.
   
   This PR:
   
   - Validates `applicationData` JSON before decoding.
   - Rejects non-object top-level JSON values.
   - Rejects non-object `actionContext` values.
   - Adds a 1 MiB size limit for `applicationData`.
   - Returns deterministic unretryable branch failure statuses instead of 
panicking.
   - Ensures Getty and gRPC commit/rollback processors send failed branch 
responses when the Resource Manager returns an error.
   - Prevents unknown `BranchType` values from causing a panic.
   - Avoids logging the complete `applicationData` payload.
   - Adds table-driven, processor, and fuzz tests.
   
   **Which issue(s) this PR fixes**:
   
   <!--
   *Automatically closes linked issue when PR is merged.
   Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
   _If PR is about `failing-tests or flakes`, please post the related 
issues/tests in a comment and do not use `Fixes`_*
   -->
   
   Fixes #1157 
   
   **Special notes for your reviewer**:
   Malformed `applicationData` is treated as invalid input and does not invoke 
the TCC business callback.
   
   For invalid input:
   
   - Commit returns `BranchStatusPhasetwoCommitFailedUnretryable`.
   - Rollback returns `BranchStatusPhasetwoRollbackFailedUnretryable`.
   - Getty and gRPC both return `ResultCode=Failed` responses to the TC.
   
   The 1 MiB payload limit and the unretryable status behavior are intentional. 
Existing valid TCC payloads remain wire-compatible.
   
   **Does this PR introduce a user-facing change?**:
   Yes. Previously, malformed branch requests could panic and terminate the RM 
client. They now produce a failed branch response without terminating the 
process.
   <!--
   If no, just write "NONE" in the release-note block below.
   If yes, a release note is required:
   Enter your extended release note in the block below. If the PR requires 
additional action from users switching to the new release, include the string 
"action required".
   -->
   
   ```release-note
   TCC branch commit and rollback now reject malformed applicationData safely 
and return failed branch responses instead of panicking.
   ```
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to