CVE-2024-35185

@@ -40,6 +40,10 @@ import (
 const (
 	// RestRuleDataIngestType is the type of the REST rule data ingest engine
 	RestRuleDataIngestType = "rest"
+
+	// MaxBytesLimit is the maximum number of bytes to read from the response body
+	// We limit to 1MB to prevent abuse
+	MaxBytesLimit int64 = 1 << 20
 )
 
 type ingestorFallback struct {
@@ -201,16 +205,18 @@ func (rdi *Ingestor) parseBody(body io.Reader) (any, error) {
 		return nil, nil
 	}
 
+	lr := io.LimitReader(body, MaxBytesLimit)
+
 	if rdi.restCfg.Parse == "json" {
 		var jsonData any
-		dec := json.NewDecoder(body)
+		dec := json.NewDecoder(lr)
 		if err := dec.Decode(&jsonData); err != nil {
 			return nil, fmt.Errorf("cannot decode json: %w", err)
 		}
 
 		data = jsonData
 	} else {
-		data, err = io.ReadAll(body)
+		data, err = io.ReadAll(lr)
 		if err != nil {
 			return nil, fmt.Errorf("cannot read response body: %w", err)
 		}

@@ -17,6 +17,7 @@ package rest
 
 import (
 	"context"
+	"encoding/binary"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -319,3 +320,54 @@ func TestRestIngest(t *testing.T) {
 		})
 	}
 }
+
+func TestIngestor_parseBodyDoesNotReadTooLargeRequests(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		cfg     *pb.RestType
+		body    string
+		wantErr bool
+	}{
+		{
+			name: "raw",
+			cfg:  &pb.RestType{},
+			// really large body
+			// casting to `int` should work.
+			body: strings.Repeat("a", int(MaxBytesLimit)+1),
+			// This case does not error, it simply truncates.
+			wantErr: false,
+		},
+		{
+			name: "json",
+			cfg: &pb.RestType{
+				Parse: "json",
+			},
+			// really large body
+			// casting to `int` should work.
+			body: "{\"a\":\"" + strings.Repeat("a", int(MaxBytesLimit)+1) + "\"}",
+			// This case will error out, as truncating
+			// makes the JSON invalid.
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			rdi := &Ingestor{
+				restCfg: tt.cfg,
+			}
+
+			got, err := rdi.parseBody(strings.NewReader(tt.body))
+			if tt.wantErr {
+				assert.Error(t, err, "expected error")
+			} else {
+				assert.NoError(t, err, "expected no error")
+				assert.Equal(t, int(MaxBytesLimit), binary.Size(got), "expected body to be truncated")
+			}
+		})
+	}
+}