fn inflate(
h: &HeaderMap,
body: Bytes,
max: usize,
) -> Result<Bytes, (StatusCode, String)>Expand description
Undo Content-Encoding before anything tries to parse the body.
Returning the body untouched for a missing or identity header is the
common path. An encoding we do not implement is 415, not a decode failure:
the exporter has to be told to stop offering it, and a protobuf parser fed
deflate reports “invalid wire type” — a message that sends whoever reads it
looking for corruption instead of a header.
max caps what comes out, which the body limit does not: a few kilobytes
of gzipped zeros expand to gigabytes and read_to_end will allocate every
one of them. It is the same number as the body limit rather than a multiple
of it, because that makes one configured value mean one thing — the largest
export Mira will decode — however it arrived. A ratio would be the obvious
alternative and does not work: a real batch, the same attribute keys over
and over, reaches about 35:1, and there is no ratio above that which a bomb
cannot also sit under.