Bobby Ho 0207a9824f fix: enforce max body size on CSP violation report endpoint (#27243) ...

The `/api/v2/csp/reports` endpoint is unauthenticated and CSRF-exempt,
since it's the browser's `report-uri` target, and decoded request bodies
with no size limit. This let an attacker post arbitrarily large JSON
bodies to force unbounded heap allocation and OOM the server (Cure53
CDM-02-007).

Wraps the request body in `http.MaxBytesReader` before decoding and
returns 413 when the limit is exceeded, matching the existing convention
used by `files.go`, `aitasks.go`, and `exp_chats.go`.

Fixes: https://github.com/coder/security-disclosures/issues/171

2026-07-14 12:29:38 -07:00

..

agent-api

chore: adopt markdownlint and markdown-table-formatter for *.md (#15831)

2025-01-03 13:12:59 +00:00

api

fix: enforce max body size on CSP violation report endpoint (#27243)

2026-07-14 12:29:38 -07:00

cli

docs: wrap placeholder syntax in backticks in CLI help and swagger annotations (#27194)

2026-07-14 13:39:58 -04:00

index.md

chore: adopt markdownlint and markdown-table-formatter for *.md (#15831)

2025-01-03 13:12:59 +00:00