🛡️ all: limit http response body size

Author: database64128

internal/httpreq/httpreq.go

@@ -57,3 +57,21 @@ func NewFormRequest(ctx context.Context, method, url string, values url.Values)
 	req.Header["Content-Type"] = []string{"application/x-www-form-urlencoded"}
 	return req, nil
 }
+
+// ReadResponseBody reads up to maxSize bytes from the response body into buf.
+// If the size of the response body exceeds maxSize, an error is returned.
+func ReadResponseBody(buf *bytes.Buffer, resp *http.Response, maxSize int64) error {
+	if resp.ContentLength > maxSize {
+		return fmt.Errorf("response body too large: %d bytes (max %d bytes)", resp.ContentLength, maxSize)
+	}
+	buf.Grow(max(0, int(resp.ContentLength)))
+	r := io.LimitReader(resp.Body, maxSize+1)
+	n, err := io.Copy(buf, r)
+	if err != nil {
+		return err
+	}
+	if n > maxSize {
+		return fmt.Errorf("response body too large: %d bytes (max %d bytes)", n, maxSize)
+	}
+	return nil
+}

internal/httpreq/httpreq_test.go

@@ -0,0 +1,93 @@
+package httpreq_test
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/database64128/ddns-go/internal/httpreq"
+)
+
+func TestReadResponseBody(t *testing.T) {
+	for _, c := range [...]struct {
+		name    string
+		resp    http.Response
+		maxSize int64
+		wantLen int
+		wantErr bool
+	}{
+		{
+			name: "SuccessExactContentLength",
+			resp: http.Response{
+				Body:          io.NopCloser(strings.NewReader("Hello, World!")),
+				ContentLength: 13,
+			},
+			maxSize: 20,
+			wantLen: 13,
+			wantErr: false,
+		},
+		{
+			name: "SuccessShortContentLength",
+			resp: http.Response{
+				Body:          io.NopCloser(strings.NewReader("Hello, World!")),
+				ContentLength: 5,
+			},
+			maxSize: 20,
+			wantLen: 13,
+			wantErr: false,
+		},
+		{
+			name: "SuccessNoContentLength",
+			resp: http.Response{
+				Body:          io.NopCloser(strings.NewReader("Hello, World!")),
+				ContentLength: -1,
+			},
+			maxSize: 20,
+			wantLen: 13,
+			wantErr: false,
+		},
+		{
+			name: "SuccessExactMaxSize",
+			resp: http.Response{
+				Body:          io.NopCloser(strings.NewReader("Hello, World!")),
+				ContentLength: 13,
+			},
+			maxSize: 13,
+			wantLen: 13,
+			wantErr: false,
+		},
+		{
+			name: "ErrorContentLengthExceedsMaxSize",
+			resp: http.Response{
+				Body:          io.NopCloser(strings.NewReader("Hello, World!")),
+				ContentLength: 30,
+			},
+			maxSize: 20,
+			wantLen: 0,
+			wantErr: true,
+		},
+		{
+			name: "ErrorReadExceedsMaxSize",
+			resp: http.Response{
+				Body:          io.NopCloser(strings.NewReader("Hello, World!")),
+				ContentLength: -1,
+			},
+			maxSize: 5,
+			wantLen: 6,
+			wantErr: true,
+		},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			err := httpreq.ReadResponseBody(&buf, &c.resp, c.maxSize)
+			if (err != nil) != c.wantErr {
+				t.Errorf("ReadResponseBody() error = %v, wantErr %v", err, c.wantErr)
+			}
+			if got := buf.Len(); got != c.wantLen {
+				t.Errorf("ReadResponseBody() read %d bytes, want %d", got, c.wantLen)
+			}
+		})
+	}
+}

producer/asusrouter/asusrouter.go

@@ -8,6 +8,7 @@ import (
 	"encoding/xml"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"net/netip"
 	"net/url"
@@ -136,6 +137,9 @@ func (s *Source) Snapshot(ctx context.Context) (producer.Message, error) {
 		return producer.Message{}, fmt.Errorf("AJAX status failed with status %d", resp.StatusCode)
 	}
 
+	const maxResponseBodySize = 1024 * 1024 // 1 MiB
+	r := io.LimitReader(resp.Body, maxResponseBodySize)
+
 	// Parse the XML response and extract the IP address.
 	// The response is expected to be in the following format:
 	//
@@ -151,7 +155,7 @@ func (s *Source) Snapshot(ctx context.Context) (producer.Message, error) {
 	}
 
 	var dm deviceMap
-	if err := xml.NewDecoder(resp.Body).Decode(&dm); err != nil {
+	if err := xml.NewDecoder(r).Decode(&dm); err != nil {
 		return producer.Message{}, fmt.Errorf("failed to decode AJAX status XML: %w", err)
 	}
 

producer/ipapi/text.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io"
 	"net"
 	"net/http"
 	"net/netip"
@@ -129,19 +128,22 @@ func (s *textSource) get(ctx context.Context) (netip.Addr, error) {
 	if err != nil {
 		return netip.Addr{}, fmt.Errorf("failed to send request: %w", err)
 	}
+	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
-	resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return netip.Addr{}, fmt.Errorf("unexpected status code %d: %q", resp.StatusCode, body)
-	}
-	if err != nil {
+	const maxResponseBodySize = int64(len("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff") + 25) // 64
+	var buf bytes.Buffer
+	if err = httpreq.ReadResponseBody(&buf, resp, maxResponseBodySize); err != nil {
 		return netip.Addr{}, fmt.Errorf("failed to read response body: %w", err)
 	}
+	bodyBytes := buf.Bytes()
+
+	if resp.StatusCode != http.StatusOK {
+		return netip.Addr{}, fmt.Errorf("unexpected status code %d: %q", resp.StatusCode, bodyBytes)
+	}
 
-	body = bytes.TrimSpace(body)
+	bodyBytes = bytes.TrimSpace(bodyBytes)
 
-	addr, err := netip.ParseAddr(string(body))
+	addr, err := netip.ParseAddr(string(bodyBytes))
 	if err != nil {
 		return netip.Addr{}, fmt.Errorf("failed to parse IP address: %w", err)
 	}

provider/cloudflare/client.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -237,9 +236,9 @@ func clientDo[R any](client *http.Client, authorizationHeader string, newRequest
 	}
 	defer resp.Body.Close()
 
+	const maxResponseBodySize = 128 * 1024 * 1024 // 128 MiB
 	var buf bytes.Buffer
-	buf.Grow(max(0, int(resp.ContentLength)))
-	if _, err = io.Copy(&buf, resp.Body); err != nil {
+	if err = httpreq.ReadResponseBody(&buf, resp, maxResponseBodySize); err != nil {
 		return result, fmt.Errorf("failed to read response: %w", err)
 	}
 	bodyBytes := buf.Bytes()