From 35436c979e301a607791c634c69f4ed698adcda4 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Sat, 14 Mar 2026 23:20:16 -0700 Subject: [PATCH] Webhooks: clean up request body guards --- extensions/mattermost/src/mattermost/slash-http.ts | 2 -- extensions/nextcloud-talk/src/monitor.ts | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/extensions/mattermost/src/mattermost/slash-http.ts b/extensions/mattermost/src/mattermost/slash-http.ts index e8259caac62..a094b3571ff 100644 --- a/extensions/mattermost/src/mattermost/slash-http.ts +++ b/extensions/mattermost/src/mattermost/slash-http.ts @@ -209,8 +209,6 @@ async function authorizeSlashInvocation(params: { export function createSlashCommandHttpHandler(params: SlashHttpHandlerParams) { const { account, cfg, runtime, commandTokens, triggerMap, log } = params; - const MAX_BODY_BYTES = 64 * 1024; // 64KB - return async (req: IncomingMessage, res: ServerResponse): Promise => { if (req.method !== "POST") { res.statusCode = 405; diff --git a/extensions/nextcloud-talk/src/monitor.ts b/extensions/nextcloud-talk/src/monitor.ts index 900b3201fcc..d66a40d7429 100644 --- a/extensions/nextcloud-talk/src/monitor.ts +++ b/extensions/nextcloud-talk/src/monitor.ts @@ -173,6 +173,8 @@ export function readNextcloudTalkWebhookBody( maxBodyBytes: number, ): Promise { return readRequestBodyWithLimit(req, { + // This read happens before signature verification, so keep the unauthenticated + // body budget bounded even if the operator-configured post-parse limit is larger. maxBytes: Math.min(maxBodyBytes, PREAUTH_WEBHOOK_MAX_BODY_BYTES), timeoutMs: PREAUTH_WEBHOOK_BODY_TIMEOUT_MS, });