6f2b4450df
Planner-audit #9. \`fetchSegment\` previously \`await response.json()\` on any body BRouter returned. A misbehaving or compromised upstream could OOM the planner process by returning gigabytes of JSON. New \`readBodyWithCap()\`: - Reject upfront when \`content-length\` declares over the cap. - Stream the body and abort the reader once received bytes exceed the cap (handles the case where upstream lies about content-length or omits it). Cap chosen at 10 MB — real per-segment GeoJSON is <100 KB; even the longest realistic multi-day route stays well under 2 MB. Above 10 MB is upstream bug or abuse; we'd rather error. Applied to both \`fetchSegment\` (GeoJSON path) and \`computeSegmentGpx\` (GPX path). Tests: 3 cases (within cap, content-length over cap, streamed body mid-cap abort). |
||
|---|---|---|
| .. | ||
| journal | ||
| mobile | ||
| planner | ||