stream-cap rates responses instead of buffering then checking size

resp.bytes() already pulls the whole body into memory before the 5MB
check ran, so a malicious server could still OOM the process during
download. read_body_capped aborts mid-stream once the cap is hit.

also fix goal-seek probe fallback: it could update lo/hi to a genuine
bracket without ever setting found=true, throwing "no solution" on
cases that do have one.

src-tauri/Cargo.lock

@@ -3038,6 +3038,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-core",
+ "futures-util",
  "http",
  "http-body",
  "http-body-util",
@@ -3057,12 +3058,14 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-rustls",
+ "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wasm-streams 0.4.2",
  "web-sys",
  "webpki-roots",
 ]
@@ -3102,7 +3105,7 @@ dependencies = [
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams",
+ "wasm-streams 0.5.0",
  "web-sys",
 ]
 
@@ -4924,6 +4927,19 @@ dependencies = [
  "wasmparser",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "wasm-streams"
 version = "0.5.0"

src-tauri/Cargo.toml

@@ -18,7 +18,7 @@ tauri-plugin-updater = "2"
 tauri-plugin-process = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
 chrono = "0.4"
 futures = "0.3.32"
 

src-tauri/src/main.rs

@@ -320,6 +320,24 @@ async fn read_rates_cache(app: &AppHandle) -> Option<RatesCache> {
     serde_json::from_str(&raw).ok()
 }
 
+const RATES_RESPONSE_LIMIT: usize = 5 * 1024 * 1024;
+
+/// Reads the body as a stream and aborts as soon as it exceeds `limit`,
+/// instead of buffering an unbounded body in memory before checking its size.
+async fn read_body_capped(resp: reqwest::Response, limit: usize) -> Result<Vec<u8>, String> {
+    use futures::StreamExt;
+    let mut stream = resp.bytes_stream();
+    let mut buf = Vec::new();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk.map_err(|e| e.to_string())?;
+        buf.extend_from_slice(&chunk);
+        if buf.len() > limit {
+            return Err("response too large".into());
+        }
+    }
+    Ok(buf)
+}
+
 async fn fetch_rates_online() -> Result<RatesPayload, String> {
     let client = HTTP_CLIENT.get_or_init(|| {
         reqwest::Client::builder()
@@ -334,10 +352,7 @@ async fn fetch_rates_online() -> Result<RatesPayload, String> {
         .await
         .map_err(|e| e.to_string())?;
 
-    let bytes = resp.bytes().await.map_err(|e| e.to_string())?;
-    if bytes.len() > 5 * 1024 * 1024 {
-        return Err("rates api response too large".into());
-    }
+    let bytes = read_body_capped(resp, RATES_RESPONSE_LIMIT).await?;
     let body: serde_json::Value = serde_json::from_slice(&bytes).map_err(|e| e.to_string())?;
 
     if body["result"] != "success" {
@@ -352,14 +367,12 @@ async fn fetch_rates_online() -> Result<RatesPayload, String> {
         ids.join(",")
     );
     if let Ok(resp) = client.get(&url).send().await {
-        if let Ok(bytes) = resp.bytes().await {
-            if bytes.len() <= 5 * 1024 * 1024 {
-                if let Ok(json) = serde_json::from_slice::<serde_json::Value>(&bytes) {
-                    for (code, id) in CRYPTO {
-                        if let Some(price) = json[id]["usd"].as_f64() {
-                            if price > 0.0 {
-                                rates.insert((*code).into(), serde_json::json!(1.0 / price));
-                            }
+        if let Ok(bytes) = read_body_capped(resp, RATES_RESPONSE_LIMIT).await {
+            if let Ok(json) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                for (code, id) in CRYPTO {
+                    if let Some(price) = json[id]["usd"].as_f64() {
+                        if price > 0.0 {
+                            rates.insert((*code).into(), serde_json::json!(1.0 / price));
                         }
                     }
                 }
@@ -558,10 +571,7 @@ async fn fetch_historical_rates(
         .await
         .map_err(|e| e.to_string())?;
 
-    let bytes = resp.bytes().await.map_err(|e| e.to_string())?;
-    if bytes.len() > 5 * 1024 * 1024 {
-        return Err("rates api response too large".into());
-    }
+    let bytes = read_body_capped(resp, RATES_RESPONSE_LIMIT).await?;
     let body: serde_json::Value = serde_json::from_slice(&bytes).map_err(|e| e.to_string())?;
     let rates = parse_rate_map(body["rates"].as_object().ok_or("no rates in response")?);
     if let Ok(serialized) = serde_json::to_string(&rates) {
@@ -614,17 +624,15 @@ async fn fetch_historical_rates_batch(
         futures.push(async move {
             let mut rate_map = None;
             if let Ok(resp) = client_clone.get(&url).send().await {
-                if let Ok(bytes) = resp.bytes().await {
-                    if bytes.len() <= 5 * 1024 * 1024 {
-                        if let Ok(body) = serde_json::from_slice::<serde_json::Value>(&bytes) {
-                            if let Some(rates_obj) = body["rates"].as_object() {
-                                let daily_rates = parse_rate_map(rates_obj);
-                                let cache_path = data_dir(&app_clone).join(format!("rates-{}.json", date));
-                                if let Ok(serialized) = serde_json::to_string(&daily_rates) {
-                                    write_atomic_async(cache_path, serialized).await;
-                                }
-                                rate_map = Some((date, daily_rates));
+                if let Ok(bytes) = read_body_capped(resp, RATES_RESPONSE_LIMIT).await {
+                    if let Ok(body) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                        if let Some(rates_obj) = body["rates"].as_object() {
+                            let daily_rates = parse_rate_map(rates_obj);
+                            let cache_path = data_dir(&app_clone).join(format!("rates-{}.json", date));
+                            if let Ok(serialized) = serde_json::to_string(&daily_rates) {
+                                write_atomic_async(cache_path, serialized).await;
                             }
+                            rate_map = Some((date, daily_rates));
                         }
                     }
                 }

src/engine/evaluator.ts

@@ -424,12 +424,13 @@ function evalGoalSeek(lhsNode: Node, rhsNode: Node, ctx: EvalCtx): Value {
     for (const p of probes) {
       const pDec = new Decimal(p);
       const fp = safeEval(pDec);
-      if (fp !== null) {
-        if (flo === null) { lo = pDec; flo = fp; }
-        else if (flo.mul(fp).lte(0)) { hi = pDec; fhi = fp; found = true; break; }
-        else if (fhi === null) { hi = pDec; fhi = fp; }
-        else if (fhi.mul(fp).lte(0)) { lo = pDec; flo = fp; found = true; break; }
-      }
+      if (fp === null) continue;
+      if (flo === null) { lo = pDec; flo = fp; }
+      else if (fhi === null) { hi = pDec; fhi = fp; }
+      else if (flo.mul(fp).lte(0)) { hi = pDec; fhi = fp; }
+      else if (fhi.mul(fp).lte(0)) { lo = pDec; flo = fp; }
+      else continue;
+      if (flo !== null && fhi !== null && flo.mul(fhi).lte(0)) { found = true; break; }
     }
     if (!found) throw new EvalError("no solution");
   }