fix(blaze): bound HTTP request bodies by WeissonHan · Pull Request #2293 · alibaba/anolisa

WeissonHan · 2026-08-06T21:20:37Z

Why

Guest exec, read, and write already use a bounded HTTP envelope, but daemon
routes without a dedicated envelope could still buffer the complete request
body before dispatch. That now includes template import, which accepts
operator-supplied JSON large enough to make the missing ordinary-route boundary
an immediate release concern.

The daemon needs one predictable per-request limit for ordinary routes without
reducing the larger envelope required for guest file transfer.

What changed

Before:

Guest exec/read/write stopped collecting above their existing 22 MiB
envelope.
Other routes, including template import, could collect until the peer stopped
sending.
Ordinary routes had no configurable body limit or stable size-error code.

After:

Routes without a specialized envelope use the new positive
api.max_body_bytes setting, which defaults to 1 MiB.
One shared collector checks every declared Content-Length before polling
the body and also stops when streamed bytes first cross the selected limit.
Missing or understated lengths cannot bypass the streamed-byte check.
Invalid, empty, or conflicting length values and body-read failures return
HTTP 400; ordinary size violations return HTTP 413 with
request_too_large.
The request_too_large code is reserved for HTTP collection limits. Other
payload-capacity failures may also return HTTP 413, but do not use this code.
Guest exec/read/write retain their existing 22 MiB envelope and
guest_request_too_large response.
Tests prove that both an ordinary sandbox route and template import use the
configured boundary before dispatch.
The example configuration and bilingual component/user documentation define
the same route-specific behavior.

The request flow becomes:

HTTP request
    -> select route limit
       -> guest exec/read/write: existing 22 MiB envelope
       -> every other route: api.max_body_bytes
    -> validate all Content-Length values
    -> collect streamed frames only up to the selected limit
       -> malformed/read failure: 400
       -> declared or observed overflow: 413
       -> bounded body: dispatch route

Commit

9daea49ed7a8 — bound daemon HTTP request bodies. Adds the
configuration contract, shared collector, 400/413 mapping, route-specific
limit selection, focused tests, example, and bilingual documentation.

These changes belong in one PR because they implement one daemon-entry
boundary. The configuration selects the limit, the collector enforces it, the
API maps its result, and the tests and documentation define the same observable
contract. Splitting any of those pieces would leave either an unenforced
setting, an undocumented behavior change, or a collector without stable API
semantics.

Still to do

Obtain maintainer approval and merge this fix before the target release is
cut; the fixes linkage then closes blaze: bound HTTP request body collection #2292.

Related issue

fixes #2292

User and operator impact

Existing configurations remain valid and receive the 1 MiB ordinary-route
default. An ordinary request above that limit now receives HTTP 413 instead of
being fully buffered. Operators whose ordinary requests intentionally exceed
1 MiB can set a larger positive api.max_body_bytes value before deployment.

Guest command and file routes remain capped at 22 MiB independently of this
setting, so their existing 16 MiB decoded-file limit and error code do not
change. The new boundary applies per request; it does not cap aggregate memory
across concurrent requests.

Risk and compatibility

Public CLI, API, configuration, or documented behavior changed
Privileged or security-sensitive behavior changed
Cross-component contract changed
Compatibility or rollback guidance is needed

The configuration field is optional and defaults through serde, so existing
files continue to parse. The compatibility change is intentional: ordinary
bodies above 1 MiB are rejected by default. Set api.max_body_bytes to a
suitable positive byte count before deployment when an existing caller needs a
larger ordinary payload. A zero value is rejected during configuration
validation.

Validation

Exact public commit:
9daea49ed7a8adc35a62b8b7db2d44079d61b230

Tree:
245ae6ae29f41d6a53969b3c5a9aab97aa07d391

Parent:
ba20d94d19a73e5b781cab0c687d4034ad0d0dae

GitHub's merge ref is
018e793fc7075e56c2a55aa0d41f159a2bf7afea. Its ordered parents are the
current main commit and the exact public head, and it has the same tree as
the public head.

The public commit was downloaded from GitHub by exact SHA. The archive SHA-256
is:

931b010307e2160095aed9c962edb70cff5e3a47e44b97eb8659ee3b05de5611

The archive records the exact public commit, and an independent Git-object
reconstruction produced the expected tree. Native Linux x86_64 validation used
Rust and Cargo 1.88.0 with locked, offline dependencies and a separate fresh
target directory for each stage:

cargo fmt --all -- --check;
locked metadata for default and all-feature configurations;
workspace all-target builds for default and all-feature configurations;
strict Clippy for default and all-feature configurations with warnings
denied;
serial workspace tests: 314 passed by default
(blaze-core 54 and blazed 260) and 332 passed with all features
(blaze-core 54 and blazed 278), with 0 failures;
strict rustdoc for default and all-feature configurations with warnings
denied;
15/15 focused request-body, route-selection, configuration, and error-code
tests.

Repository documentation naming and bilingual parity checks, relative-link
checks, commit-message and trailer checks, and the parent-to-head
git diff --check passed against the same tree and commit message. The source
tree was reconstructed again after validation and remained unchanged.

Hosted Components, Docs, Pages, and PR Lint passed for this exact head.
Review status is reported separately by GitHub.

Documentation and rollback

The example configuration, component README in English and Chinese, and Blaze
user guide in English and Chinese document the default, override, response
status, and guest-route exception. CHANGELOG aggregation remains reserved for a
release version update.

To retain larger ordinary requests, set api.max_body_bytes to a suitable
positive byte count. Revert this commit to restore the previous ordinary-route
collection behavior.

WeissonHan · 2026-08-06T21:20:47Z

@codex review This PR bounds ordinary Blaze HTTP request bodies with a configurable default while preserving the existing guest-operation envelope.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a59f4fbd83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

WeissonHan · 2026-08-06T21:31:25Z

@codex review Please re-review the current head 9c43a28d83b9, including the public DaemonConfig::api documentation added in response to the previous finding.

chatgpt-codex-connector · 2026-08-06T21:35:05Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 9c43a28d83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

WeissonHan · 2026-08-10T06:53:16Z

@codex review This PR bounds daemon HTTP request bodies before dispatch while preserving the existing guest-operation envelope. Please review the complete pull request: every commit, the cumulative diff against the base branch, and the implementation, tests, and documentation as one submitted change.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c2e2e1e11

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

WeissonHan · 2026-08-10T07:55:29Z

@codex review This PR bounds daemon HTTP request bodies before dispatch while keeping request-body error codes distinct from other payload limits. Please review the complete pull request: every commit, the cumulative diff against the base branch, and the implementation, tests, and documentation as one submitted change.

chatgpt-codex-connector · 2026-08-10T07:59:23Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 7036cace90

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

qoderai

本次审查范围内未发现需要修改的问题。

🤖 Generated by Qoder • View workflow run

WeissonHan · 2026-08-14T05:59:24Z

@codex review This PR enforces a configurable body-size limit for ordinary Blaze HTTP routes while preserving the existing guest-operation envelope and distinct error codes.

chatgpt-codex-connector · 2026-08-14T06:02:56Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 7036cace90

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

This enables daemon routes without a dedicated protocol envelope, including template import, to reject oversized request bodies before dispatch. Use a validated api.max_body_bytes default for ordinary routes and a shared limit-aware collector that checks both Content-Length and streamed bytes. Malformed length or body reads return 400; size violations return 413. Guest exec, read, and write keep their existing 22 MiB envelope and stable error code. The limit is per request and does not bound aggregate concurrent memory. Fixes: 4ec67cf ("feat(blaze): implement sandbox guest operations (alibaba#2217)") Signed-off-by: Weisson <Weisson@linux.alibaba.com>

WeissonHan · 2026-08-15T09:53:56Z

@codex review This PR enforces a configurable body-size limit for ordinary Blaze HTTP routes while preserving the existing guest-operation envelope and distinct error codes.

chatgpt-codex-connector · 2026-08-15T09:56:33Z

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 9daea49ed7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

WeissonHan · 2026-08-16T12:10:34Z

@codex review

chatgpt-codex-connector · 2026-08-16T12:13:49Z

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 9daea49ed7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

dismiss

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

Comment thread src/blaze/crates/blaze-core/src/config.rs

WeissonHan force-pushed the fix/blaze/bound-http-request-bodies-main branch from a59f4fb to 9c43a28 Compare August 6, 2026 21:30

WeissonHan force-pushed the fix/blaze/bound-http-request-bodies-main branch from 9c43a28 to 7c2e2e1 Compare August 10, 2026 06:51

chatgpt-codex-connector Bot reviewed Aug 10, 2026

View reviewed changes

Comment thread src/blaze/crates/blazed/src/error.rs Outdated

WeissonHan force-pushed the fix/blaze/bound-http-request-bodies-main branch 2 times, most recently from cd52edf to 7036cac Compare August 10, 2026 07:52

WeissonHan marked this pull request as ready for review August 14, 2026 03:25

WeissonHan requested a review from casparant as a code owner August 14, 2026 03:25

qoderai Bot reviewed Aug 14, 2026

View reviewed changes

WeissonHan force-pushed the fix/blaze/bound-http-request-bodies-main branch from 7036cac to 9daea49 Compare August 15, 2026 09:43

This was referenced Aug 15, 2026

Remove legacy instance routes from the Blaze API #2577

Closed

feat(blaze)!: remove legacy instance routes #2585

Merged

casparant previously approved these changes Aug 16, 2026

View reviewed changes

WeissonHan mentioned this pull request Aug 16, 2026

feat(blaze): capture sandbox checkpoints #2472

Open

4 tasks

Uh oh!

Conversation

WeissonHan commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Commit

Still to do

Related issue

User and operator impact

Risk and compatibility

Validation

Documentation and rollback

Uh oh!

WeissonHan commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

WeissonHan commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 6, 2026

Uh oh!

WeissonHan commented Aug 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

WeissonHan commented Aug 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 10, 2026

Uh oh!

qoderai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

WeissonHan commented Aug 14, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 14, 2026

Uh oh!

WeissonHan commented Aug 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 15, 2026

Uh oh!

WeissonHan commented Aug 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

WeissonHan commented Aug 6, 2026 •

edited

Loading