Security: Request body size limit + streaming upload validation #80

New issue

Closed

opened 2026-07-08 02:40:30 +00:00 by icub3d · 0 comments

icub3d commented

2026-07-08 02:40:30 +00:00

Owner

Severity: High — found in code review 2026-07-07. (Rate limiting is tracked separately in #48; this is the body-size / buffering half.)

Problem

No DefaultBodyLimit/RequestBodyLimitLayer is configured anywhere (main.rs adds only CORS). The effective ceiling is axum's implicit default, not config.content.max_file_size (default 25 MB).
Uploads are fully buffered into memory before the size check: attachments/handlers.rs:145 and profiles/handlers.rs:130 call field.bytes().await first, then compare against the limit. The attachment loop accumulates across many fields.

Impact: memory exhaustion via large or many upload fields.

Fix

Add a RequestBodyLimitLayer/DefaultBodyLimit sized from config.
Stream fields with a running byte counter that aborts past the limit before fully buffering.

**Severity: High** — found in code review 2026-07-07. (Rate limiting is tracked separately in #48; this is the body-size / buffering half.) ## Problem - No `DefaultBodyLimit`/`RequestBodyLimitLayer` is configured anywhere (`main.rs` adds only CORS). The effective ceiling is axum's implicit default, not `config.content.max_file_size` (default 25 MB). - Uploads are **fully buffered into memory before** the size check: `attachments/handlers.rs:145` and `profiles/handlers.rs:130` call `field.bytes().await` first, then compare against the limit. The attachment loop accumulates across many fields. **Impact:** memory exhaustion via large or many upload fields. ## Fix - [ ] Add a `RequestBodyLimitLayer`/`DefaultBodyLimit` sized from config. - [ ] Stream fields with a running byte counter that aborts past the limit before fully buffering.

icub3d added the

area:api

status:planned

type:bug

labels

2026-07-08 02:40:30 +00:00

icub3d referenced this issue

2026-07-08 02:40:47 +00:00

Feature: API and Gateway Rate Limiting #48

icub3d referenced this issue from a commit

2026-07-08 03:45:15 +00:00

fix(server): bound request body size to prevent upload memory DoS