fix(fetchers): enforce twitter fetch hardening limits#124
Merged
chaliy merged 2 commits intoMay 17, 2026
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
TwitterFetcherfollowed upstream redirects and buffered API responses without honoringFetchOptionslimits, which could enable SSRF or large-body exhaustion for Twitter/X syndication and oEmbed responses.Description
reqwest::redirect::Policy::none()to avoid unvalidated redirect hops.response.text()/response.json()with the shared streaming helperread_body_with_timeout(response, BODY_TIMEOUT, max_size)and fall back toDEFAULT_MAX_BODY_SIZEwhenoptions.max_body_sizeis unset.serde_json::from_stron the bounded buffer (converted to UTF-8 lossily) and parse oEmbed viaserde_json::from_sliceon the bounded bytes, and add theuseimport for the helper symbols.Testing
cargo fmt --allwhich completed successfully.cargo test -p fetchkit twitter::tests -- --nocaptureand the twitter fetcher tests all passed (20 passed, 0 failed).Codex Task