From fa3c446baf674bfe4e6c70b92809030ed067b098 Mon Sep 17 00:00:00 2001
From: Dorian <dorian@Dorians-MacBook-Air.local>
Date: Fri, 6 Mar 2026 01:38:39 +0000
Subject: [PATCH] fix(app): add 1MB body size limit to Claude proxy

Track accumulated body size during req.on('data') and abort with 413
if it exceeds 1MB, preventing unbounded memory allocation from
oversized payloads.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 packages/app/server/claude-proxy.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/packages/app/server/claude-proxy.ts b/packages/app/server/claude-proxy.ts
index 49f373f1..9fcb3a65 100644
--- a/packages/app/server/claude-proxy.ts
+++ b/packages/app/server/claude-proxy.ts
@@ -293,9 +293,20 @@ const server = createServer((req, res) => {
   if (!validateDevAuth(req, res)) return
   if (!checkRateLimit(req, res, true)) return
 
+  const MAX_BODY_SIZE = 1 * 1024 * 1024 // 1 MB
   let body = ''
-  req.on('data', (chunk) => { body += chunk })
+  let aborted = false
+  req.on('data', (chunk) => {
+    body += chunk
+    if (body.length > MAX_BODY_SIZE) {
+      aborted = true
+      res.writeHead(413, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: 'Request body too large (max 1MB)' }))
+      req.destroy()
+    }
+  })
   req.on('end', () => {
+    if (aborted) return
     if (req.url === '/v1/openrouter') {
       console.log('[proxy] → OpenRouter proxy')
       streamOpenRouterProxy(body, res)