mirror of
https://github.com/block/buzz.git
synced 2026-10-30 14:01:37 +00:00
34c9f56c0b
Routing the viewer through the generic fetch_media_bytes command meant an attachment with a forged or absent imeta size could occupy up to the 50 MiB download cap in memory and IPC before the frontend decoder rejected it. Add a markdown-specific fetch_markdown_doc_bytes command whose 2 MiB cap is owned by Rust: an oversized Content-Length is refused before the body is read, and the streamed byte count aborts mid-transfer when the header is missing or dishonest. The untrusted imeta pre-gate stays UX-only. The cap checks are extracted into pure helpers (declared_length_refusal_error, append_chunk_within_cap) so both enforcement points are unit-tested without a Tauri State; media_download.rs tests move to a sibling file per the repo's _tests.rs convention to stay under the per-file line cap. The panel maps the native refusal onto the existing too-large download fallback, and new e2e coverage proves the forged-size fallback plus the reload/back-forward contract. The viewer command skips MIME sniffing deliberately: bytes are strictly UTF-8-decoded and rendered escaped, and a legitimate .md may begin with bytes that sniff as a blocked type. Signed-off-by: Riley Crane <rileycrane@squareup.com> Co-authored-by: Fizz <d4ec90109b43092b0ec94cf136850915a3732a29ab3089a1dec43d2ed43dd6eb@buzz.block.builderlab.xyz> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>