mirror of
https://github.com/go-admin-team/go-admin.git
synced 2026-09-23 18:58:09 +00:00
zhangwenjian
1b5b52f0f1
LoggerToFile is registered on the engine, so every POST, PUT, GET and DELETE had its body copied into memory - through a bytes.Buffer, a ReadAll and a string conversion - before any handler ran. The only consumer is operParam on the operation-log row, which is written when logger.enableddb is on, and that is off in the shipped configuration. There was no size limit either, and a file upload is a POST like any other: a 1MB request allocated 4.3MB here and a 16MB upload allocated about 67MB, to build a value nobody stored. The body is now read only when the operation log will use it, and at most 32KB of it. The handler still receives the whole request: it reads the copied part from memory and the rest from the connection, so what this holds is bounded however large the request is. 32KB also keeps the value inside the TEXT column it is written to. The bufio.Writer this replaces was never flushed. Nothing was truncated only because bytes.Buffer implements io.ReaderFrom, so io.Copy bypassed the buffer entirely - a different destination would have dropped the tail of every request body.