opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(line): add request body size limit to webhook handler

Browse source 
Prevent unauthenticated DoS via unbounded io.ReadAll on webhook
request body. Apply the same io.LimitReader pattern used by the
WeCom channel (4 MB cap) to reject oversized POST payloads before
signature verification or JSON parsing.

Fixes #1407
This commit is contained in:
Subash 2026-03-13 07:58:47 +05:30
parent 3bcbfd99b9
commit 0a6453ffb8
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkg/channels/line/line.go
View file

@ -166,7 +166,9 @@ func (c *LINEChannel) webhookHandler(w http.ResponseWriter, r *http.Request) {
return return
} }
body, err := io.ReadAll(r.Body) // Limit request body to 4 MB to prevent memory exhaustion (DoS).
const maxBodySize = 4 << 20 // 4 MB
body, err := io.ReadAll(io.LimitReader(r.Body, maxBodySize+1))
if err != nil { if err != nil {
logger.ErrorCF("line", "Failed to read request body", map[string]any{ logger.ErrorCF("line", "Failed to read request body", map[string]any{
"error": err.Error(), "error": err.Error(),
@ -174,6 +176,10 @@ func (c *LINEChannel) webhookHandler(w http.ResponseWriter, r *http.Request) {
http.Error(w, "Bad request", http.StatusBadRequest) http.Error(w, "Bad request", http.StatusBadRequest)
return return
} }
if len(body) > maxBodySize {
http.Error(w, "Request body too large", http.StatusRequestEntityTooLarge)
return
}
signature := r.Header.Get("X-Line-Signature") signature := r.Header.Get("X-Line-Signature")
if !c.verifySignature(body, signature) { if !c.verifySignature(body, signature) {