Function readBodyForDecode

internal/server/middleware_request_text.go:708–721

readBodyForDecode reads the whole request body so it can be scanned before it is decoded, with the caller's size cap applied. Buffering is not a cost paid for the scan. json.Decoder.Decode already holds the entire top-level value in memory before it finishes — refill accumulates into dec.buf and gr

(r *http.Request, maxBytes int64)

// 512.5 MiB. Peak heap is indistinguishable between the first two and is
// order-dependent, so it does not discriminate. BUG-2803.
func readBodyForDecode(r *http.Request, maxBytes int64) ([]byte, error) {
	if r.Body == nil {
		return nil, io.EOF
	}
	// The nil ResponseWriter is deliberate and its consequence is worth
	// stating, because the comment this replaces got it wrong twice over:
	// MaxBytesReader.Close forwards to the underlying body rather than being
	// a no-op, and with a nil writer there is no automatic 413 — hitting the
	// cap surfaces as a read error, which decodeJSONWithLimit wraps and every
	// caller turns into a 400. That is the existing behaviour, unchanged
	// here; only the claim about it is corrected (codex round 8).
	r.Body = http.MaxBytesReader(nil, r.Body, maxBytes)
	return io.ReadAll(r.Body)
}

// truncateBindableText cuts s to at most maxBytes bytes WITHOUT splitting a
// rune, so the result is still valid UTF-8.