fix: bound response reads in workflow catalog fetch

[Quratulain-bilal]

Replace 2 unbounded
esp.read() calls with
ead_response_limited() in workflows/catalog.py (WorkflowCatalog and StepCatalog fetch paths) to prevent DoS via oversized catalog responses.

[Copilot]

Pull request overview

Bounds workflow and step catalog response reads to mitigate oversized-response denial-of-service risks.

Changes:

• Applies the 1 MiB metadata limit to both catalog fetch paths.
• Raises catalog-specific errors for oversized responses.

Show a summary per file

File	Description
src/specify_cli/workflows/catalog.py	Adds bounded reads for workflow and step catalogs.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

src/specify_cli/workflows/catalog.py:1219

• Please cover the step-catalog path independently with an oversized streamed response and assert that JSON parsing is not attempted. This is a separate fetch implementation, and the existing read_response_limited unit tests do not verify that this call site continues to enforce the catalog-size boundary.

                    read_response_limited(resp, max_bytes=MAX_JSON_METADATA_BYTES, error_type=StepCatalogError)

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Medium

[mnriem]

Please address Copilot feedback and resolve conflicts

[Copilot]

Review details

Suppressed comments (1)

tests/test_workflows.py:6721

• The described production fix is absent from the proposed changes: this PR only adds tests, while both read_response_limited() calls in workflows/catalog.py are already present and the immediately preceding regression tests already verify oversized responses are rejected. As submitted, these additions neither perform the stated replacement nor add distinct coverage. Please either include the intended production diff (if it is still needed) or revise the PR scope and avoid duplicating the existing tests.

    def test_fetch_skips_json_parse_on_oversized_response(
        self, project_dir, monkeypatch
    ):
        """Regression: json.loads must never be reached when the response
        exceeds MAX_JSON_CATALOG_BYTES — the bounded reader must reject it
        first."""

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

tests/test_workflows.py:7742

• The production change described by this PR is absent from the diff: only regression tests are added, while the adjacent pre-existing oversized-response tests already verify the same size-limit error for both catalog paths. Please include the intended workflows/catalog.py replacements, or update the PR scope and consolidate this assertion into the existing tests if that fix has already landed elsewhere.

    def test_fetch_skips_json_parse_on_oversized_response(
        self, project_dir, monkeypatch
    ):

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[mnriem]

Please address test & lint errors

[github-actions]

This pull request has been automatically marked as stale because it has had no activity for 60 days. It will be closed in 30 days unless there is a substantive update. If you intend to continue, please describe the current status, address or acknowledge outstanding feedback, and confirm whether the branch can be updated and the change remains ready for review. A comment that only states that the pull request is "still relevant" does not provide enough context for maintainers.

[Copilot]

🟡 Changes recommended

The step-catalog test patches the wrong module and will fail.

1 open finding

• Patch MAX_JSON_CATALOG_BYTES in the step-catalog module · New

🧠 Review effort: Balanced

[mnriem]

Please address Copilot feedback