Unbounded Stream or Payload Allocation Across Polyglot Boundaries

Remediation checklist

• Go: wrap HTTP request bodies with http.MaxBytesReader(w, r.Body, maxBytes) or wrap generic io.Reader streams with io.LimitReader(r, maxBytes+1) and reject len(data) > maxBytes.
• TypeScript & JavaScript: enforce an explicit maxBytes accumulator guard when reading ReadableStreams, req.arrayBuffer(), or Node 'data' chunks; Python: pass an explicit byte cap to stream.read(MAX_BYTES + 1) and reject len(buf) > MAX_BYTES.
• Java & Kotlin: use InputStream.readNBytes(MAX_BYTES + 1) instead of readAllBytes() / readBytes(); C#: enforce MaxRequestBodySize or bounded Stream/PipeReader buffers; Rust: wrap Read/AsyncRead with reader.take(MAX_BYTES + 1) before read_to_end/read_to_string.
• C/C++: read fixed-ceiling buffers via istream::read / recv with explicit byte bounds; Ruby: call io.read(MAX_BYTES + 1) and check bytesize; PHP: pass maxlength to stream_get_contents($s, MAX_BYTES + 1) or file_get_contents('php://input', false, null, 0, MAX_BYTES + 1); Swift: use FileHandle.read(upToCount: maxBytes + 1).

Illustrative Code Examples

These fragments explain migration direction. They are not complete applications or compiler-verified patches for your project.

// Go: unbounded io.ReadAll on attacker-controlled body
data, err := io.ReadAll(r.Body)

# Python: unbounded .read() on request stream
payload = request.stream.read()

// PHP: unbounded php://input read
$raw = file_get_contents('php://input');

// Go: 1 MiB ceiling via http.MaxBytesReader
r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
data, err := io.ReadAll(r.Body)

# Python: 10 MiB ceiling + fail-closed check
payload = request.stream.read(10_485_761)
if len(payload) > 10_485_760:
    raise ValueError("payload exceeds limit")