From c3e58fdab8e4d3a1a1e676aa945b962816d15823 Mon Sep 17 00:00:00 2001 From: Dorian Date: Fri, 6 Mar 2026 01:27:35 +0000 Subject: [PATCH] fix(app): add body size limit to dev-chats write endpoint Track accumulated body length during PUT /api/dev-chats and abort with 413 if payload exceeds 5MB. Co-Authored-By: Claude Opus 4.6 --- packages/app/vite-dev-chats.ts | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/packages/app/vite-dev-chats.ts b/packages/app/vite-dev-chats.ts index 7cc0b247..db845788 100644 --- a/packages/app/vite-dev-chats.ts +++ b/packages/app/vite-dev-chats.ts @@ -5,6 +5,7 @@ import { validateDevAuth } from './server/dev-auth' const CHATS_DIR = '.dev' const CHATS_FILE = 'chats.json' +const MAX_BODY_SIZE = 5 * 1024 * 1024 // 5MB function getChatsPath(root: string): string { const dir = resolve(root, CHATS_DIR) @@ -48,8 +49,18 @@ export function devChatsPlugin(): Plugin { if (req.method === 'PUT') { let body = '' - req.on('data', (chunk: Buffer) => { body += chunk.toString() }) + let exceeded = false + req.on('data', (chunk: Buffer) => { + if (exceeded) return + body += chunk.toString() + if (body.length > MAX_BODY_SIZE) { + exceeded = true + res.writeHead(413, { 'Content-Type': 'application/json' }) + res.end(JSON.stringify({ error: 'Payload too large (max 5MB)' })) + } + }) req.on('end', () => { + if (exceeded) return try { JSON.parse(body) writeChats(chatsPath, body)