Skip to content

[EXPORTER] OTLP HTTP exporter reads unbounded response#4078

Merged
marcalff merged 5 commits into
open-telemetry:mainfrom
marcalff:fix_unbounded_http
May 12, 2026
Merged

[EXPORTER] OTLP HTTP exporter reads unbounded response#4078
marcalff merged 5 commits into
open-telemetry:mainfrom
marcalff:fix_unbounded_http

Conversation

@marcalff
Copy link
Copy Markdown
Member

@marcalff marcalff commented May 12, 2026

Fixes #3958

Changes

Please provide a brief description of the changes here.

  • Implemented max size limits in the CURL HTTP code
  • Restrict the amount of memory consumed when parsing HTTP responses.

For significant contributions please make sure you have completed the following items:

  • CHANGELOG.md updated for non-trivial changes
  • Unit tests have been added
  • Changes in public API reviewed

@marcalff marcalff added the pr:please-review This PR is ready for review label May 12, 2026
@codecov
Copy link
Copy Markdown

codecov Bot commented May 12, 2026

Codecov Report

❌ Patch coverage is 47.05882% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.94%. Comparing base (f0c7212) to head (e4bd460).

Files with missing lines Patch % Lines
ext/src/http/client/curl/http_operation_curl.cc 47.06% 18 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #4078      +/-   ##
==========================================
- Coverage   82.02%   81.94%   -0.07%     
==========================================
  Files         385      385              
  Lines       16007    16034      +27     
==========================================
+ Hits        13128    13138      +10     
- Misses       2879     2896      +17     
Files with missing lines Coverage Δ
...lemetry/ext/http/client/curl/http_operation_curl.h 90.91% <ø> (ø)
ext/src/http/client/curl/http_operation_curl.cc 58.75% <47.06%> (-0.70%) ⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@marcalff marcalff marked this pull request as ready for review May 12, 2026 12:41
@marcalff marcalff requested a review from a team as a code owner May 12, 2026 12:41
Copy link
Copy Markdown
Member

@dbarker dbarker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix. Please see questions below.

Comment thread ext/src/http/client/curl/http_operation_curl.cc
Comment thread ext/src/http/client/curl/http_operation_curl.cc Outdated
@marcalff marcalff merged commit 7184d1e into open-telemetry:main May 12, 2026
70 checks passed
@marcalff marcalff added CVE Common Vulnerabilities and Exposures bug Something isn't working security and removed pr:please-review This PR is ready for review labels May 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working CVE Common Vulnerabilities and Exposures security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[EXPORTER] OTLP HTTP exporter reads unbounded response

3 participants