go-pkgz / auth / 26195016784

85%

master: 85%

Build Type

Pull #290

github

Committed by paskal

Commit Message

refactor(avatar): collapse load/resize double-buffering

Before this change a remote avatar was buffered twice: once inside load() to
enforce maxAvatarFetchSize before returning an io.ReadCloser, and again inside
resize() when it called io.ReadAll on that reader to feed image.DecodeConfig.
For a 10 MiB upstream avatar each in-flight login held ~20 MiB peak instead of
~10 MiB. Bounded, but wasteful under concurrent login pressure.

Collapse the duplication by moving the size cap to the trust boundary and
flowing bytes straight through:

  * load() now returns ([]byte, error). No Reader wrapping, no Close needed
    at the caller, no second ReadAll downstream.
  * resize() takes ([]byte, int) instead of (io.Reader, int). It works on the
    same bytes load() already validated against the cap, with a defensive
    len(body) == 0 || > cap check for callers that bypass load (identicon,
    PutContent).
  * PutContent() now runs io.ReadAll(io.LimitReader(content, cap+1)) at the
    public API boundary so the cap is visible to callers reading the code.
    The total work is the same — resize used to do this internally — but
    the size enforcement is now explicit at the trust boundary.
  * Put()'s deferred body.Close() block is gone since load returns bytes.
  * The identicon path drops bytes.NewBuffer(b) wrapping and passes b directly.

No public API change, no behavior change other than halved peak memory per
concurrent login. All existing tests pass on both v1 and v2 unchanged in
intent — only the test inputs were simplified to pass []byte directly to
resize instead of wrapping in strings.NewReader / bytes.NewReader.

Pull Request Pull Request #290: fix(avatar): prevent stored XSS via content-type spoofing

Coverage Stats

85 of 93 new or added lines in 2 files covered. (91.4%)

3 existing lines in 1 file now uncovered.

3032 of 3551 relevant lines covered (85.38%)

8.28 hits per line