Correct, if someone opts in and ends up hitting a malicious server, there are no other mitigations at the moment for eagerly reading response body, ie just Req.get. When using streaming, via into: fun, one can keep an accumulator of read bytes and and bail; automatic decompression for :into was never available in the first place (that’s something I plan to allow in future release however).
Im planning to revamp streaming from into: fun to an explicit Req.stream(req, acc, fun), and allow streaming decompression AND decoding. And a :max_body_size option, which I think will have to default to :infinity however, so at least that’d be an easy knob to turn. Stay tuned.
