[A-EDev]

Summary

Bounds every read from a store or peer (spec/store.md "Untrusted input", Flow-Tube/flow-sync#75):

• HTTP: ResponseBody.bytesUpTo(limit) reads through OkHttp's source and fails past the limit. Objects, blobs and keys 4 MiB; JSON, mailbox messages and WebDAV listings 16 MiB. This also bounds GroupStore.download and FileLayout before anything reaches disk.
• Live: a new sync/transport/BoundedListener cancels the socket on a message over 64 KiB (OkHttp 5.4 has no inbound size setting).
• LAN: WsServer sets Ktor maxFrameSize and WsClient uses BoundedListener; both default to unlimited, so FLOW-SYNC/1 is unchanged, and v2 LAN sync and pairing pass 4 MiB + 1/16. LanLink.receive refuses content over 4 MiB, as Flow Desktop does.
  Inbound channels stay unbounded: backpressure would stall ping handling and kill busy sockets, and each message is now bounded.

Related issue

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• ./gradlew :app:assembleGithubDebug: not run on this branch; CI builds the APK
• ./gradlew --offline :app:testGithubDebugUnitTest --tests 'io.github.aedev.flow.sync2.*' --tests 'io.github.aedev.flow.sync.*': 160 sync2 and 166 sync tests (162 + 4 new transport tests), 0 failures. New: ServerStoreTest and WebDavStoreTest.answers_past_their_limit_are_refused (4 MiB accepted, 4 MiB + 1 and a 16 MiB+ JSON body refused), LanLinkTest, BoundedListenerTest (2), WsServerTest, WsClientTest. Before: the store tests failed with AssertionError
• ./gradlew --offline ktlintCheck: passed
• I manually tested the affected behavior on an Android device or emulator.

Test device and Android version: not device-tested yet

Risk and compatibility

Nightly note added. A LAN get answer with a full 4 MiB object plus its header line is over the frame payload limit (on Flow Desktop too); objects that large are rare, and the spec's frame limit needs a clarification for it.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources.
• Dependency and lockfile changes are intentional and limited to this PR.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.