Is zapros safe?

GHSA-6cp7-3m3c-5x5c

Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit (iterbytes(chunksize=...)) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory.

import gzip, zapros

# Server returns ~1 GiB of zeros gzip-compressed to ~1 MiB,
# with header: Content-Encoding: gzip
bomb = gzip.compress(b"\0" * 1_000_000_000)  # ~1 MiB on the wire

with zapros.stream("GET", "https://malicious.example/bomb") as response:
    # Caller asks for 8 KiB chunks, expecting bounded memory:
    for chunk in response.iter_bytes(chunk_size=8192):
        ...  # first `chunk` is ~1 GiB, not 8 KiB -> memory exhaustion

Upgrade to 0.14.0 or later. The decoders now bound the output of each decompression step to the requested chunksize: gzip/deflate via zlib's maxlength + unconsumedtail, brotli via outputbufferlimit, and zstd via a bounded streamwriter. Peak memory during streaming decode is now proportional to chunksize for all supported encodings.

For unpatched versions:

• Read the still-compressed body with Response.iterraw() / Response.asynciterraw(), which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. zlib's maxlength), aborting once a configured limit is exceeded.
• Where feasible, send Accept-Encoding: identity to disable response compression so bodies are not decompressed client-side.
• Avoid decoding response bodies from untrusted servers.