Problem
The CSV and RTF parsers appear to materialize cells/text without a bound on the number of cells or the decompressed text size. A crafted (or accidentally pathological) CSV/RTF input could exhaust memory during conversion.
Expected outcome
Enforce limits analogous to the existing max_entry_bytes/resource-limit checks (or a row/cell count cap) for CSV/RTF, surfacing a resourceLimit error instead of unbounded allocation.
Context
Raised while adopting firecrawl-anydoc 0.1.9 as a Python dependency (GroktoCrawl parse-svc). Applies to the Rust core and all bindings. A 50 MB request cap in the consuming service is only a partial mitigation.
Problem
The CSV and RTF parsers appear to materialize cells/text without a bound on the number of cells or the decompressed text size. A crafted (or accidentally pathological) CSV/RTF input could exhaust memory during conversion.
Expected outcome
Enforce limits analogous to the existing
max_entry_bytes/resource-limit checks (or a row/cell count cap) for CSV/RTF, surfacing aresourceLimiterror instead of unbounded allocation.Context
Raised while adopting
firecrawl-anydoc0.1.9 as a Python dependency (GroktoCrawl parse-svc). Applies to the Rust core and all bindings. A 50 MB request cap in the consuming service is only a partial mitigation.