limit response for HTTP adapters to 32kb

[dimroc]

Note that this implementation ignores http header Content-Length because a malicious user could lie, and we would have to count the bytes of the payload anyways.

[j16r]

Would it be better to use a uint64 here for toRead and remaining to avoid an overflow?

[dimroc]

I kept it as a int64 because this variable is also shared with the RequestSizeLimiter, used in router.go as middleware, and takes an int64.

	engine.Use(
		limits.RequestSizeLimiter(config.DefaultHTTPLimit()), // <--- int64 also used here
		loggerFunc(),
		gin.Recovery(),
		cors,
		secureMiddleware(config),
	)

https://github.com/gin-contrib/size/blob/master/size.go#L79

func RequestSizeLimiter(limit int64) gin.HandlerFunc {

Wanted to avoid punting the overflow to when I cast a uint64 to int64. I'm indifferent though, so open to suggestions.

[j16r]

[j16r]

Why would we cal mbr.rc.Read if mbr.remaining == 0?

[dimroc]

I believe this is captured in this comment, but let's chat offline about it:

		// The underlying io.Reader may not return (0, io.EOF)
		// at EOF if the requested size is 0, so read 1 byte
		// instead. The io.Reader docs are a bit ambiguous
		// about the return value of Read when 0 bytes are
		// requested, and {bytes,strings}.Reader gets it wrong
		// too (it returns (0, nil) even at EOF).

Referenced from: https://github.com/gin-contrib/size/blob/master/size.go#L33