Mirrors/continuwuity
1
0
Fork 0
mirror of https://forgejo.ellis.link/continuwuation/continuwuity.git synced 2026-05-26 20:49:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Limit body read size of remote requests (CWE-409)

Browse Source 
Reviewed-By: Jade Ellis <jade@ellis.link>
This commit is contained in:
timedout
2026-03-03 19:54:34 +00:00
parent 7207398a9e
commit 37888fb670
14 changed files with 192 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/service/announcements/mod.rs
+2 -2
View File
@@ -18,7 +18,7 @@
use std::{sync::Arc, time::Duration};
use async_trait::async_trait;
use conduwuit::{Result, Server, debug, error, warn};
use conduwuit::{Result, Server, debug, error, utils::response::LimitReadExt, warn};
use database::{Deserialized, Map};
use ruma::events::{Mentions, room::message::RoomMessageEventContent};
use serde::Deserialize;
@@ -137,7 +137,7 @@ impl Service {
.get(CHECK_FOR_ANNOUNCEMENTS_URL)
.send()
.await?
.text()
.limit_read_text(1024 * 1024)
.await?;
let response = serde_json::from_str::<CheckForAnnouncementsResponse>(&response)?;