opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(line): add request body size limit to webhook handler to prevent DoS

Browse source 
- Add MaxWebhookBodySize constant (1MB) for LINE webhook requests
- Use http.MaxBytesReader to limit request body size
- Return 413 status code when request body exceeds limit

Fixes #1407
This commit is contained in:
曾文锋0668000834 2026-03-12 20:38:09 +08:00
parent 19835b2f60
commit f64ad75705
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
pkg/channels/line/line.go
View file

@ -163,6 +163,9 @@ func (c *LINEChannel) ServeHTTP(w http.ResponseWriter, r *http.Request) {
c.webhookHandler(w, r) c.webhookHandler(w, r)
} }
// MaxWebhookBodySize is the maximum allowed size for LINE webhook request body (1MB)
const MaxWebhookBodySize = 1 << 20 // 1MB
// webhookHandler handles incoming LINE webhook requests. // webhookHandler handles incoming LINE webhook requests.
func (c *LINEChannel) webhookHandler(w http.ResponseWriter, r *http.Request) { func (c *LINEChannel) webhookHandler(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPost { if r.Method != http.MethodPost {
@ -175,7 +178,11 @@ func (c *LINEChannel) webhookHandler(w http.ResponseWriter, r *http.Request) {
logger.ErrorCF("line", "Failed to read request body", map[string]any{ logger.ErrorCF("line", "Failed to read request body", map[string]any{
"error": err.Error(), "error": err.Error(),
}) })
if err.Error() == "http: request body too large" {
http.Error(w, "Request body too large", http.StatusRequestEntityTooLarge)
} else {
http.Error(w, "Bad request", http.StatusBadRequest) http.Error(w, "Bad request", http.StatusBadRequest)
}
return return
} }
if int64(len(body)) > maxWebhookBodySize { if int64(len(body)) > maxWebhookBodySize {