fix: limit the number of bytes read from an HTTP response (#629)

favonia · Nov 4, 2023 · d64e8d4 · d64e8d4
1 parent 9f456ff
commit d64e8d4
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 7 deletions.
diff --git a/internal/config/network_probe.go b/internal/config/network_probe.go
@@ -2,7 +2,6 @@ package config
 
 import (
 	"context"
-	"io"
 	"net/http"
 	"time"
 
@@ -24,9 +23,7 @@ func ProbeURL(ctx context.Context, url string) bool {
 	if err != nil {
 		return false
 	}
-	defer resp.Body.Close()
-
-	_, err = io.ReadAll(resp.Body)
+	err = resp.Body.Close()
 	return err == nil
 }
 

diff --git a/internal/monitor/base.go b/internal/monitor/base.go
@@ -9,6 +9,9 @@ import (
 
 //go:generate mockgen -typed -destination=../mocks/mock_monitor.go -package=mocks . Monitor
 
+// maxReadLength is the maximum number of bytes read from an HTTP response.
+const maxReadLength int64 = 102400
+
 // Monitor is a dead man's switch, meaning that the user will be notified when the updater fails to
 // detect and update the public IP address. No notifications for IP changes.
 type Monitor interface {

diff --git a/internal/monitor/healthchecks.go b/internal/monitor/healthchecks.go
@@ -130,7 +130,7 @@ func (h *Healthchecks) ping(ctx context.Context, ppfmt pp.PP, endpoint string, m
 		return false
 	}
 	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxReadLength))
 	if err != nil {
 		ppfmt.Warningf(pp.EmojiError,
 			"Failed to read HTTP(S) response from the %s endpoint of Healthchecks: %v",

diff --git a/internal/monitor/uptimekuma.go b/internal/monitor/uptimekuma.go
@@ -3,6 +3,7 @@ package monitor
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/url"
 	"slices"
@@ -135,7 +136,7 @@ func (h *UptimeKuma) ping(ctx context.Context, ppfmt pp.PP, param UptimeKumaRequ
 	defer resp.Body.Close()
 
 	var parsedResp UptimeKumaResponse
-	if err = json.NewDecoder(resp.Body).Decode(&parsedResp); err != nil {
+	if err = json.NewDecoder(io.LimitReader(resp.Body, maxReadLength)).Decode(&parsedResp); err != nil {
 		ppfmt.Warningf(pp.EmojiError, "Failed to parse the response from Uptime Kuma: %v", err)
 		return false
 	}

diff --git a/internal/provider/protocol/httpcore.go b/internal/provider/protocol/httpcore.go
@@ -10,6 +10,9 @@ import (
 	"github.com/favonia/cloudflare-ddns/internal/pp"
 )
 
+// maxReadLength is the maximum number of bytes read from an HTTP response.
+const maxReadLength int64 = 102400
+
 type httpCore struct {
 	url               string
 	method            string
@@ -41,7 +44,7 @@ func (h *httpCore) getIP(ctx context.Context, ppfmt pp.PP) (netip.Addr, bool) {
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxReadLength))
 	if err != nil {
 		ppfmt.Warningf(pp.EmojiError, "Failed to read HTTP(S) response from %q: %v", h.url, err)
 		return invalidIP, false