Vulnerable functions
ofrep.handler.HandleFlagEvaluationflagd/pkg/service/flag-evaluation/ofrep/ofrep_service.go
This function handles OFREP requests for single flag evaluations. It was vulnerable to excessive memory allocation because it processed request bodies without a size limit. An attacker could send an arbitrarily large request body, leading to a denial of service. The patch introduces `http.MaxBytesHandler` to enforce a limit on the request body size.
ofrep.handler.HandleBulkEvaluationflagd/pkg/service/flag-evaluation/ofrep/ofrep_service.go
This function handles OFREP requests for bulk flag evaluations. It was vulnerable to excessive memory allocation because it processed request bodies without a size limit. An attacker could send an arbitrarily large request body, leading to a denial of service. The patch introduces `http.MaxBytesHandler` to enforce a limit on the request body size.
v1.Service.ResolveBooleanflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for boolean flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v1.Service.ResolveStringflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for string flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v1.Service.ResolveFloatflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for float flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v1.Service.ResolveIntflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for integer flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v1.Service.ResolveObjectflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for object flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v1.Service.ResolveAllflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for resolving all flags was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v2.Service.ResolveBooleanflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for boolean flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v2.Service.ResolveStringflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for string flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v2.Service.ResolveFloatflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for float flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v2.Service.ResolveIntflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for integer flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
v2.Service.ResolveObjectflagd/pkg/service/flag-evaluation/connect_service.go
This gRPC/Connect method for object flag evaluation was exposed via an HTTP server that did not limit request body sizes. This allowed an attacker to send a large request, causing memory exhaustion and a denial of service. The patch, applied in `setupServer`, wraps the service handler with `http.MaxBytesHandler` to mitigate this.
Miggo AI