-
Notifications
You must be signed in to change notification settings - Fork 379
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
replaced stream with memoryStream for reading the message. #1027
replaced stream with memoryStream for reading the message. #1027
Conversation
@andersjonsson this is the only way i could find to dispose the memory stream |
Yeah that's not too pretty. I just realized that there might be a simpler way to fix this. |
aren't we creating the message after we create the reader, in the readMessageAsync, where do you propose the |
do you mean in
above |
My, untested, idea was to do it in ReadMessageAsync
It's still blocking but it will read the message immediately, thus the blocking should be really short. That approach could be paired with a memorystream for a simpler async version (since the memorystream can be disposed right after the creation of the buffered copy), but that will copy the request data one more time, resulting in higher memory usage. |
This reverts commit 59023fe.
I guess this could work, only thing i am worried about is even its blocking for short period, it can still cause threadpool queue for wait, but i can test this in prod and let you know if this change made any better |
also, once you merge this can you create a new version? |
Is it possible for you to use a locally linked .dll in prod? I'd rather not deploy this to nuget before we know that it's an improvement. |
It would be tricky for me to do that considering all the deployment policies, any other way you could release a nuget with a named version or something? |
I cannot checkin the whole soapcore and get to the release stage, it could violate some policies here, only way is using nuget |
Ok, I thought that maybe you could compile your own version of soapcore and include the dll in your builds. Ran some benchmarks for three implementations. The original one, the one you have, and one that reads the request to a memorystream asynchronously and then creates a buffered copy.
The buffered ones are a lot slower and uses a lot more memory. I think that there could be benefits to the throughput but it's hard to be sure. I think, based on this test, that I'd be ok with giving the version with memorystream a shot. That one avoids blocking and doesn't seem to perform much worse than the blocking one.
What do you think? If you agree, please change your PR and I'll merge it |
this looks good, will modify |
{ | ||
var streamReaderWithEncoding = new StreamReader(ms, readEncoding); | ||
var xmlReaderSettings = new XmlReaderSettings() { IgnoreWhitespace = true, DtdProcessing = DtdProcessing.Prohibit, CloseInput = true }; | ||
reader = XmlReader.Create(streamReaderWithEncoding, xmlReaderSettings); |
Check failure
Code scanning / CodeQL
Untrusted XML is read insecurely Critical
user-provided value
This insecure XML processing depends on a
user-provided value
Thanks! We'll see how this goes I'll publish new release to nuget |
Thanks for all the efforts!! appreciate it. Will dig deeper for content length thing. and will also let you know about the performance |
No description provided.