storm/skald
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Limit the size of API requests.

Browse Source 
Thanks to Vinayak Mishra.
This commit is contained in:
Juliusz Chroboczek
2026-04-07 15:47:11 +02:00
parent 2b4952fcf1
commit d76f594130
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webserver/api.go
+8 -2
View File
@@ -84,6 +84,8 @@ func sendJSON(w http.ResponseWriter, r *http.Request, v any) {
e.Encode(v) e.Encode(v)
} }
const maxAPIMessageSize = 1024 * 1024
func getText(w http.ResponseWriter, r *http.Request) ([]byte, bool) { func getText(w http.ResponseWriter, r *http.Request) ([]byte, bool) {
ctype, _, err := mime.ParseMediaType(r.Header.Get("Content-Type")) ctype, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
if err != nil || !strings.EqualFold(ctype, "text/plain") { if err != nil || !strings.EqualFold(ctype, "text/plain") {
@@ -93,7 +95,9 @@ func getText(w http.ResponseWriter, r *http.Request) ([]byte, bool) {
return nil, true return nil, true
} }
body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 4096)) body, err := io.ReadAll(
http.MaxBytesReader(w, r.Body, maxAPIMessageSize),
)
if err != nil { if err != nil {
httpError(w, err) httpError(w, err)
return nil, true return nil, true
@@ -111,7 +115,9 @@ func getJSON(w http.ResponseWriter, r *http.Request, v any) bool {
return true return true
} }
d := json.NewDecoder(r.Body) d := json.NewDecoder(
http.MaxBytesReader(w, r.Body, maxAPIMessageSize),
)
err = d.Decode(v) err = d.Decode(v)
if err != nil { if err != nil {
httpError(w, err) httpError(w, err)