Skip to content

Conversation

@MartinquaXD
Copy link
Contributor

@MartinquaXD MartinquaXD commented Jan 23, 2026

Description

Some solvers reported that some requests come significantly delayed (judging by the auction deadline). Currently we have no way to distinguish between receiving the start of the /solve request and streaming the actual data.
This PR makes this possible by making the solve handler take a raw http request and stream the body afterwards.

Changes

Instead of:

  1. collecting the whole body into a String (including utf8 check)
  2. logging that we received a request
  3. putting that String into an Arc to make copying it cheap
  4. deserializing the string into a SolveRequest

We now do:

  1. receive raw http request
  2. log that we received it
  3. stream the body into a cheaply copyable Bytes type
  4. log how long the data transfer took
  5. deserialize raw bytes into SolveRequest

Since handling the raw request seems to bypass axum's request size checks I did it manually for this endpoint.

How to test

Existing tests should suffice

@MartinquaXD MartinquaXD requested a review from a team as a code owner January 23, 2026 10:00
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors the /solve endpoint to measure the duration of request body data transfer, which helps in diagnosing reported delays. The implementation correctly changes the endpoint to accept a raw HTTP request and streams the body to hyper::body::Bytes while timing the operation. However, this change introduces a critical security vulnerability. By processing the raw request body without a size limit, the service is exposed to a Denial of Service attack via memory exhaustion from an overly large request payload. My review includes a comment with a suggested fix to mitigate this vulnerability by applying a size limit to the request body.

futures = { workspace = true }
const-hex = { workspace = true }
hex-literal = { workspace = true }
http-body = { workspace = true }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like you're not using this, at least directly. If I had to guess, you added this but then hyper had this built in?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, exactly.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't you remove this dep then? Or did we misunderstood each other?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants