From ccc26624e8963781b9729967d7b53c6158e07988 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Tue, 2 Dec 2025 16:37:30 +0000 Subject: [PATCH] security: Add request body size limits to notification handlers Add http.MaxBytesReader limits to prevent memory exhaustion attacks: - UpdateEmailConfig: 32KB limit - UpdateAppriseConfig: 64KB limit - CreateWebhook: 64KB limit - UpdateWebhook: 64KB limit This follows the pattern already used in system_settings.go for SSH config validation. --- internal/api/notifications.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/internal/api/notifications.go b/internal/api/notifications.go index cbd24f9..39e6c38 100644 --- a/internal/api/notifications.go +++ b/internal/api/notifications.go @@ -44,6 +44,9 @@ func (h *NotificationHandlers) GetEmailConfig(w http.ResponseWriter, r *http.Req // UpdateEmailConfig updates the email configuration func (h *NotificationHandlers) UpdateEmailConfig(w http.ResponseWriter, r *http.Request) { + // Limit request body to 32KB to prevent memory exhaustion + r.Body = http.MaxBytesReader(w, r.Body, 32*1024) + // Read raw body for debugging body, err := io.ReadAll(r.Body) if err != nil { @@ -100,6 +103,9 @@ func (h *NotificationHandlers) GetAppriseConfig(w http.ResponseWriter, r *http.R // UpdateAppriseConfig updates the Apprise configuration. func (h *NotificationHandlers) UpdateAppriseConfig(w http.ResponseWriter, r *http.Request) { + // Limit request body to 64KB to prevent memory exhaustion + r.Body = http.MaxBytesReader(w, r.Body, 64*1024) + body, err := io.ReadAll(r.Body) if err != nil { http.Error(w, err.Error(), http.StatusBadRequest) @@ -187,6 +193,9 @@ func (h *NotificationHandlers) GetWebhooks(w http.ResponseWriter, r *http.Reques // CreateWebhook creates a new webhook func (h *NotificationHandlers) CreateWebhook(w http.ResponseWriter, r *http.Request) { + // Limit request body to 64KB to prevent memory exhaustion + r.Body = http.MaxBytesReader(w, r.Body, 64*1024) + // Read the raw body to preserve all fields bodyBytes, err := io.ReadAll(r.Body) if err != nil { @@ -244,6 +253,9 @@ func (h *NotificationHandlers) UpdateWebhook(w http.ResponseWriter, r *http.Requ return } + // Limit request body to 64KB to prevent memory exhaustion + r.Body = http.MaxBytesReader(w, r.Body, 64*1024) + // Read the raw body to preserve all fields bodyBytes, err := io.ReadAll(r.Body) if err != nil {