User Request
Type: bug
Target: Console Application
Submitted by: @aashu2006
Console Request ID: d7dc6175-4262-4366-8152-f1d302649c12
Description
What happened:
In pkg/api/handlers/sse.go:641, limit is parsed with c.QueryInt and no upper bound cap, then passed directly to h.k8sClient.GetEvents. GetWarningEventsStream correctly uses parseWarningEventsLimit which clamps to 500. A caller can request ?limit=2147483647 causing each cluster goroutine to attempt fetching billions of events.
What I expected:
GetEventsStream should use the same parseWarningEventsLimit pattern or apply an equivalent inline clamp before passing to the fetch function.
Steps to reproduce:
- Call
GET /mcp/events/stream?limit=2147483647
- Observe each cluster goroutine attempts to fetch billions of events
This issue was automatically created from the KubeStellar Console.
User Request
Type: bug
Target: Console Application
Submitted by: @aashu2006
Console Request ID: d7dc6175-4262-4366-8152-f1d302649c12
Description
What happened:
In
pkg/api/handlers/sse.go:641,limitis parsed withc.QueryIntand no upper bound cap, then passed directly toh.k8sClient.GetEvents.GetWarningEventsStreamcorrectly usesparseWarningEventsLimitwhich clamps to 500. A caller can request?limit=2147483647causing each cluster goroutine to attempt fetching billions of events.What I expected:
GetEventsStreamshould use the sameparseWarningEventsLimitpattern or apply an equivalent inline clamp before passing to the fetch function.Steps to reproduce:
GET /mcp/events/stream?limit=2147483647This issue was automatically created from the KubeStellar Console.