From f64ad757050bcb9a7ae67045e0fc0897eea9b4bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9B=BE=E6=96=87=E9=94=8B0668000834?=
 <zeng.wenfeng@xydigit.com>
Date: Thu, 12 Mar 2026 20:38:09 +0800
Subject: [PATCH] fix(line): add request body size limit to webhook handler to
 prevent DoS

- Add MaxWebhookBodySize constant (1MB) for LINE webhook requests
- Use http.MaxBytesReader to limit request body size
- Return 413 status code when request body exceeds limit

Fixes #1407
---
 pkg/channels/line/line.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkg/channels/line/line.go b/pkg/channels/line/line.go
index 56ba02183..33f4d8799 100644
--- a/pkg/channels/line/line.go
+++ b/pkg/channels/line/line.go
@@ -163,6 +163,9 @@ func (c *LINEChannel) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	c.webhookHandler(w, r)
 }
 
+// MaxWebhookBodySize is the maximum allowed size for LINE webhook request body (1MB)
+const MaxWebhookBodySize = 1 << 20 // 1MB
+
 // webhookHandler handles incoming LINE webhook requests.
 func (c *LINEChannel) webhookHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
@@ -175,7 +178,11 @@ func (c *LINEChannel) webhookHandler(w http.ResponseWriter, r *http.Request) {
 		logger.ErrorCF("line", "Failed to read request body", map[string]any{
 			"error": err.Error(),
 		})
-		http.Error(w, "Bad request", http.StatusBadRequest)
+		if err.Error() == "http: request body too large" {
+			http.Error(w, "Request body too large", http.StatusRequestEntityTooLarge)
+		} else {
+			http.Error(w, "Bad request", http.StatusBadRequest)
+		}
 		return
 	}
 	if int64(len(body)) > maxWebhookBodySize {