From c8968e54fb15776440a135d8493fbc2950c91b25 Mon Sep 17 00:00:00 2001 From: famfo Date: Mon, 24 Feb 2025 03:25:29 +0100 Subject: [PATCH] modules/activitypub: add size limitation for received data --- modules/activitypub/client.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/modules/activitypub/client.go b/modules/activitypub/client.go index d43e9c2bb0..91c767c589 100644 --- a/modules/activitypub/client.go +++ b/modules/activitypub/client.go @@ -191,10 +191,17 @@ func (c *Client) GetBody(uri string) ([]byte, error) { return nil, err } defer response.Body.Close() - body, err := io.ReadAll(response.Body) + if response.ContentLength > setting.Federation.MaxSize { + return nil, fmt.Errorf("Request returned %d bytes (max allowed incomming size: %d bytes)", response.ContentLength, setting.Federation.MaxSize) + } else if response.ContentLength == -1 { + log.Warn("Request to %v returned an unknown content length, response may be truncated to %d bytes", uri, setting.Federation.MaxSize) + } + + body, err := io.ReadAll(io.LimitReader(response.Body, setting.Federation.MaxSize)) if err != nil { return nil, err } + log.Debug("Client: got body: %v", charLimiter(string(body), 120)) return body, nil }