Skip to content

fix(fetchers): enforce twitter fetch hardening limits#124

Merged
chaliy merged 2 commits into
mainfrom
2026-05-17-propose-fix-for-twitterfetcher-vulnerability
May 17, 2026
Merged

fix(fetchers): enforce twitter fetch hardening limits#124
chaliy merged 2 commits into
mainfrom
2026-05-17-propose-fix-for-twitterfetcher-vulnerability

Conversation

@chaliy
Copy link
Copy Markdown
Contributor

@chaliy chaliy commented May 17, 2026

Motivation

  • Close a hardening bypass where TwitterFetcher followed upstream redirects and buffered API responses without honoring FetchOptions limits, which could enable SSRF or large-body exhaustion for Twitter/X syndication and oEmbed responses.

Description

  • Disable automatic redirect following for the Twitter-specific client by using reqwest::redirect::Policy::none() to avoid unvalidated redirect hops.
  • Enforce configured body-size and timeout limits by replacing response.text() / response.json() with the shared streaming helper read_body_with_timeout(response, BODY_TIMEOUT, max_size) and fall back to DEFAULT_MAX_BODY_SIZE when options.max_body_size is unset.
  • Parse syndication JSON via serde_json::from_str on the bounded buffer (converted to UTF-8 lossily) and parse oEmbed via serde_json::from_slice on the bounded bytes, and add the use import for the helper symbols.

Testing

  • Ran formatter with cargo fmt --all which completed successfully.
  • Ran the targeted Rust unit tests with cargo test -p fetchkit twitter::tests -- --nocapture and the twitter fetcher tests all passed (20 passed, 0 failed).

Codex Task

@chaliy chaliy merged commit 82936ad into main May 17, 2026
11 checks passed
@chaliy chaliy deleted the 2026-05-17-propose-fix-for-twitterfetcher-vulnerability branch May 17, 2026 18:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant