Aias00 opened a new issue, #6837: URL: https://github.com/apache/shenyu/issues/6837
## Description `AiProxyPlugin.doExecute` does `DataBufferUtils.join(exchange.getRequest().getBody())` (no `maxSize` overload) which aggregates the entire inbound body into a single in-memory `DataBuffer` **before** the size check at line 106 runs. The 5 MB guard fires only after the full payload is already resident in heap. ## Location - `shenyu-plugin/shenyu-plugin-ai/shenyu-plugin-ai-proxy/src/main/java/org/apache/shenyu/plugin/ai/proxy/enhanced/AiProxyPlugin.java:103-110` ## Impact A malicious/buggy client streaming a multi-GB body triggers full buffering → `OutOfMemoryError` before the 413 is ever produced. Trivially-achievable gateway DoS on any selector with the AI-proxy plugin enabled. (Mitigating factors: an upstream reverse proxy or Netty `HttpObjectAggregator` maxContentLength, if configured, could prevent this — but the plugin code itself has no defense.) ## Suggested fix Use the `DataBufferUtils.join` variant with a `maxSize` and emit 413 on `DataBufferLimitException`, or stream-count bytes and short-circuit before buffering. ## Related existing Distinct from AI-TOKENLIMITER-BODYWRITER-OOM (#6758, different plugin, response side). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
