The limit that is the load
The code below is the file exactly as it stood in axios/axios. The defect was introduced on 2016-07-09, reviewed, merged, and fixed on 2021-05-04 in commit 0ece97c7 — after 1760 days in the tree.
The commit was written by a human contributor to axios/axios, not by an agent. The ticket and the description on the next two panels are ours — a reconstruction of the case the original change made, so you meet it the way its reviewer did. The code, the defect and the dates are untouched.
Enforce maxContentLength while the response is streaming
A misbehaving upstream can send a response far larger than we are willing to hold in memory, and today we only find out once the whole body has been buffered.
Enforce `maxContentLength` as the body arrives: as soon as the accumulated response exceeds the configured limit, destroy the stream and reject. Do not rely on the `content-length` header, which is optional and can lie.
The check now runs inside the `data` handler rather than at `end`, so an oversized response is cut off mid-flight instead of being buffered to completion first.
Deliberately not trusting `content-length`: the size is measured from the bytes actually received, which is the only number an upstream cannot misreport. `Buffer.concat` gives the exact accumulated byte count including multi-byte characters, so there is no encoding-dependent drift. `maxContentLength > -1` preserves the existing opt-out.
The `stream` response type is unaffected — no buffering happens there, so there is nothing to measure. Tests cover a 2 KB limit with a 1 KB and a 3 KB body.
Our reconstruction of the argument the real change made, not a quotation of it. Fluent, specific, and not evidence of anything — which is the point.
var response = { status: res.statusCode, statusText: res.statusMessage, headers: res.headers, config: config, request: lastRequest }; if (config.responseType === 'stream') { response.data = stream; settle(resolve, reject, response); } else { var responseBuffer = []; stream.on('data', function handleStreamData(chunk) { responseBuffer.push(chunk); // make sure the content length is not over the maxContentLength if specified if (config.maxContentLength > -1 && Buffer.concat(responseBuffer).length > config.maxContentLength) { stream.destroy(); reject(createError('maxContentLength size of ' + config.maxContentLength + ' exceeded', config, null, lastRequest)); } }); stream.on('error', function handleStreamError(err) { if (req.aborted) return; reject(enhanceError(err, config, null, lastRequest)); }); stream.on('end', function handleStreamEnd() { var responseData = Buffer.concat(responseBuffer); if (config.responseType !== 'arraybuffer') { responseData = responseData.toString(config.responseEncoding); if (!config.responseEncoding || config.responseEncoding === 'utf8') { responseData = utils.stripBOM(responseData); } } response.data = responseData; settle(resolve, reject, response); }); }