Skip to content

refactor: replace all http with rpc for interaction with xLLM instance.#39

Open
weizhehuang0827 wants to merge 1 commit intojd-opensource:mainfrom
weizhehuang0827:replace_with_rpc
Open

refactor: replace all http with rpc for interaction with xLLM instance.#39
weizhehuang0827 wants to merge 1 commit intojd-opensource:mainfrom
weizhehuang0827:replace_with_rpc

Conversation

@weizhehuang0827
Copy link
Collaborator

@weizhehuang0827 weizhehuang0827 commented Jan 30, 2026

wait for xLLM pr 837

Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors the communication between the xllm_service and backend xLLM instances from HTTP to RPC, a positive change intended to improve performance and simplify communication. However, a critical high-severity Denial of Service (DoS) vulnerability has been identified in the newly introduced HTTP header parsing logic. The GetJsonContentLength function in xllm_service/http_service/service.cpp uses LOG(FATAL) for missing headers and calls std::stoul on untrusted input without exception handling, which can lead to service crashes. Additionally, undefined behavior was found in the scheduler due to a missing return statement in a lambda function. Robust error handling is required to mitigate the DoS vulnerability, and the scheduler issue needs to be resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant