A06: cap RPC request bodies and shrink the import decompression limit #11

New issue

Closed

opened 2026-08-13 09:35:03 +00:00 by nalum · 0 comments

nalum commented

2026-08-13 09:35:03 +00:00

Owner

Two related resource-exhaustion gaps:

No connect.WithReadMaxBytes anywhere (internal/server/server.go). Connect buffers whole messages, so an unauthenticated POST to Login with a huge body is a pre-auth memory-exhaustion vector. Only the Read/Write timeouts bound it, and h2c multiplexing erodes that.
Import decompression cap is 1 GiB in RAM (internal/services/system/import.go:29, io.ReadAll at :197-205). A few-MB gzip bomb legally expands to 1 GiB plus a JSON-parse copy, against a 256Mi pod limit (values.cue:80). The caller is admin — or anonymous during the setup window. The code comment itself says family archives are megabytes.

Fix

Add connect.WithReadMaxBytes to the handler options (a few MiB covers every legitimate RPC except import).
Give import its own larger ceiling and drop maxImportBytes to 64-128 MiB.

Source: OWASP Top 10 (2025) audit of v1.1.0, 2026-08-13. File references point at the v1.1.0 tree.

Two related resource-exhaustion gaps: 1. **No `connect.WithReadMaxBytes` anywhere** (`internal/server/server.go`). Connect buffers whole messages, so an unauthenticated POST to `Login` with a huge body is a pre-auth memory-exhaustion vector. Only the Read/Write timeouts bound it, and h2c multiplexing erodes that. 2. **Import decompression cap is 1 GiB in RAM** (`internal/services/system/import.go:29`, `io.ReadAll` at `:197-205`). A few-MB gzip bomb legally expands to 1 GiB plus a JSON-parse copy, against a 256Mi pod limit (`values.cue:80`). The caller is admin — or anonymous during the setup window. The code comment itself says family archives are megabytes. **Fix** - Add `connect.WithReadMaxBytes` to the handler options (a few MiB covers every legitimate RPC except import). - Give import its own larger ceiling and drop `maxImportBytes` to 64-128 MiB. --- Source: OWASP Top 10 (2025) audit of `v1.1.0`, 2026-08-13. File references point at the `v1.1.0` tree.

nalum added this to the v1.1.0 security audit milestone

2026-08-13 09:35:03 +00:00

nalum added the

security

severity/medium

labels

2026-08-13 09:35:03 +00:00

nalum added reference refs/tags/v1.1.0

2026-08-13 09:37:46 +00:00

nalum referenced this issue from a commit

2026-08-13 10:43:34 +00:00

fix(server): cap request bodies and import decompression