fix(webapp): cap the agent's body on any method and on a mixed-case path

Author: kathiekiwi

apps/webapp/app/services/dashboardAgentBodyCap.server.ts

@@ -18,6 +18,9 @@ export const DASHBOARD_AGENT_MAX_INGRESS_BYTES = MAX_MESSAGE_BODY_BYTES + INGRES
 
 const AGENT_PATH = /\/dashboard-agent(\/|$)/;
 
+/** Methods that can carry one. GET and HEAD cannot, and streaming them would be wasted work. */
+const BODY_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+
 function refuse(res: Response): void {
   if (res.headersSent) return;
   res.status(413).json({ error: MESSAGE_TOO_LARGE_ERROR, code: MESSAGE_TOO_LARGE_CODE });
@@ -51,9 +54,12 @@ export function capRequestBody(req: Request, res: Response, limit: number): void
   req.once("end", () => req.off("data", onData));
 }
 
-/** Only the agent's own paths: every other route keeps the body handling it had. */
+/**
+ * Only the agent's own paths: every other route keeps the body handling it had. Matched
+ * case-insensitively because Remix routes are, and on every method — a DELETE reads a body too.
+ */
 export function dashboardAgentBodyCap(req: Request, res: Response, next: NextFunction): void {
-  if (req.method !== "POST" || !AGENT_PATH.test(req.path)) {
+  if (!BODY_METHODS.has(req.method) || !AGENT_PATH.test(req.path.toLowerCase())) {
     next();
     return;
   }

apps/webapp/test/dashboardAgentBodyCap.test.ts

@@ -18,7 +18,7 @@ async function listen(): Promise<{ url: string; buffered: () => number }> {
   let buffered = 0;
   const app = express();
   app.use(dashboardAgentBodyCap);
-  app.post("*", async (req, res) => {
+  app.all("*", async (req, res) => {
     try {
       for await (const chunk of req) buffered += (chunk as Buffer).byteLength;
     } catch {
@@ -114,6 +114,28 @@ describe("the dashboard agent's ingress cap", () => {
     expect(await response.json()).toEqual({ bytes: size });
   });
 
+  it("caps a mixed-case path, because Remix matches routes case-insensitively", async () => {
+    const { url } = await listen();
+
+    const response = await postChunked(
+      `${url}/api/v1/Dashboard-Agent/watches/batch-check`,
+      DASHBOARD_AGENT_MAX_INGRESS_BYTES * 4
+    );
+
+    expect(response.status).toBe(413);
+  });
+
+  it("caps a DELETE, which reads a body on the alerts route", async () => {
+    const { url } = await listen();
+
+    const response = await fetch(`${url}/api/v1/dashboard-agent/alerts/ch_1`, {
+      method: "DELETE",
+      body: "x".repeat(DASHBOARD_AGENT_MAX_INGRESS_BYTES + 1024),
+    });
+
+    expect(response.status).toBe(413);
+  });
+
   it("leaves every other path alone", async () => {
     const { url, buffered } = await listen();
     const size = DASHBOARD_AGENT_MAX_INGRESS_BYTES + 1024;