From fc5923caa2bd277b48d2fcbedea17a76fcaa9f05 Mon Sep 17 00:00:00 2001
From: Yanhu <huangfuyang900204@gmail.com>
Date: Thu, 16 Apr 2026 14:33:50 +0800
Subject: [PATCH] fix: limit remote image response body to prevent memory
 exhaustion (#530)

---
 view/html.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/view/html.go b/view/html.go
index d72279b5744e9ce0fb643481e0942bed3ff0a130..6149db5ba42396abb8530a7d5d2ef05e2331130d 100644
--- a/view/html.go
+++ b/view/html.go
@@ -299,7 +299,10 @@ func fetchRemoteBase64(url string) string {
 		debugImageProtocol("remote fetch non-200 url=%s status=%d", url, resp.StatusCode)
 		return ""
 	}
-	data, err := io.ReadAll(resp.Body)
+	// Limit response body to 10 MB to prevent memory exhaustion from
+	// malicious or very large images.
+	const maxImageSize = 10 << 20 // 10 MB
+	data, err := io.ReadAll(io.LimitReader(resp.Body, maxImageSize))
 	if err != nil {
 		debugImageProtocol("remote fetch read error url=%s err=%v", url, err)
 		return ""