add max body size check

cosmos · Jan 11, 2025 · 8223989 · 8223989
1 parent 617de22
commit 8223989
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/server/v2/api/grpcgateway/interceptor.go b/server/v2/api/grpcgateway/interceptor.go
@@ -25,6 +25,8 @@ import (
 	"cosmossdk.io/server/v2/appmanager"
 )
 
+const MaxBodySize = 1 << 20 // 1 MB
+
 var _ http.Handler = &gatewayInterceptor[transaction.Tx]{}
 
 // queryMetadata holds information related to handling gateway queries.
@@ -141,6 +143,9 @@ func (g *gatewayInterceptor[T]) ServeHTTP(writer http.ResponseWriter, request *h
 }
 
 func (g *gatewayInterceptor[T]) createMessageFromPostRequest(_ context.Context, marshaler runtime.Marshaler, req *http.Request, input gogoproto.Message) (gogoproto.Message, error) {
+	if req.ContentLength > MaxBodySize {
+		return nil, status.Errorf(codes.InvalidArgument, "request body too large: %d bytes, max=%d", req.ContentLength, MaxBodySize)
+	}
 	newReader, err := utilities.IOReaderFactory(req.Body)
 	if err != nil {
 		return nil, status.Errorf(codes.InvalidArgument, "%v", err)