KEMBAR78
:seedling: limit webhook payload size to 1024 bytes by spencerschrock · Pull Request #4700 · ossf/scorecard · GitHub
Skip to content

Conversation

spencerschrock
Copy link
Member

What kind of change does this PR introduce?

infra update

What is the current behavior?

The cron webhook will read any size request.

What is the new behavior (if this is a feature change)?**

The webhook will read a max of 1KiB. A typical payload is under 150 bytes, and isn't expected to increase without substantial field or bucket renaming:

{
    "shardLoc":"gs://ossf-scorecard-data2/2025.07.07/020002/",
    "numShard":133058,
    "commitSha":"bb9c347dff6349d986baab6578a46d68a5524c62"
}
  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

NONE

Special notes for your reviewer

I did do a small manual test locally:

$ curl -d '{"shardLoc":"gs://ossf-scorecard-data2/2025.07.07/020002/","numShard":133058,"commitSha":"bb9c347dff6349d986baab6578a46d68a5524c62"}' -H "Content-Type: application/json" -X POST http://localhost:8080/
successfully tagged images
$ curl -d '<more than 1024 bytes....>' -H "Content-Type: application/json" -X POST http://localhost:8080/
unable to read request body: http: request body too large

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

NONE

A typical payload is under 150 bytes, and isn't expected to increase
without substantial field or bucket renaming:
```
{
    "shardLoc":"gs://ossf-scorecard-data2/2025.07.07/020002/",
    "numShard":133058,
    "commitSha":"bb9c347dff6349d986baab6578a46d68a5524c62"
}
```

Signed-off-by: Spencer Schrock <sschrock@google.com>
@spencerschrock spencerschrock requested a review from a team as a code owner July 10, 2025 21:36
@spencerschrock spencerschrock requested review from justaugustus and raghavkaul and removed request for a team July 10, 2025 21:36
@codecov
Copy link

codecov bot commented Jul 10, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 68.29%. Comparing base (353ed60) to head (0036a70).
Report is 199 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4700      +/-   ##
==========================================
+ Coverage   66.80%   68.29%   +1.49%     
==========================================
  Files         230      249      +19     
  Lines       16602    18898    +2296     
==========================================
+ Hits        11091    12907    +1816     
- Misses       4808     5131     +323     
- Partials      703      860     +157     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link

This pull request has been marked stale because it has been open for 10 days with no activity

@github-actions github-actions bot added the Stale label Jul 21, 2025
@spencerschrock spencerschrock enabled auto-merge (squash) July 21, 2025 18:23
@spencerschrock spencerschrock merged commit c29a04d into ossf:main Jul 21, 2025
38 checks passed
@spencerschrock spencerschrock deleted the maxbytesreader branch July 21, 2025 18:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants