decentraland / social-service-ea / 28071497370

90%

main: 90%

Pull #420

github

fix: harden multipart parsing against oversized and malformed bodies

- Cap the multipart body at 1MB: reject an oversized declared Content-Length up
  front and re-check the limit while draining, so a large (or chunked) upload
  cannot buffer unbounded into memory. The 500KB thumbnail check previously ran
  only after the entire body was already materialized.
- Return 400 (InvalidRequestError) instead of a 500 when the body is not valid
  multipart/form-data, by parsing inside a try/catch (the parse runs in the
  wrapper, before the handler's own error handling).
- Sanitize uploaded filenames down to their basename, so a client-supplied name
  can never be used to traverse the filesystem if a caller later derives a path.
- Validate that placeIds elements are strings (was only checked for being an array).
- Add a unit test for the multipart wrapper, and make the oversized-thumbnail
  integration fixture deterministic (~600KB) so it exercises the 500KB validator
  rule under the new body cap instead of generating a multi-MB image.

2240 of 2639 branches covered (84.88%)

Branch coverage included in aggregate %.

96 of 101 new or added lines in 55 files covered. (95.05%)

5510 of 6002 relevant lines covered (91.8%)

73.13 hits per line