Repository navigation
Add Content-Length and request timeout for webhook dispatch #493
Description
What
The webhook dispatcher sends HTTP requests without enforcing a maximum response size, potentially allowing a malicious webhook endpoint to send an unbounded response that consumes server memory.
Why
When the dispatcher calls webhook.sendWebhook(), it reads the full response body with response.text(). A malicious endpoint could return a multi-GB response, causing the server to run out of memory.
Scope
- Limit response body reading to a reasonable size (e.g., 1MB)
- Use AbortController with size-based limits
- Log and reject webhooks with oversized responses
Acceptance Criteria
- Response body is limited to a configurable max size
- Oversized responses are logged and treated as failures
- No memory exhaustion from malicious webhook endpoints
Technical Context
- File: src/services/webhook-dispatcher.ts:70
- Current: const responseBody = await response.text();
- Proposed: Read with a size limit using response.arrayBuffer() + check length
Activity
leadgenexpert454 commentedon Sep 30, 2026
@leadgenexpert454 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @leadgenexpert454 to this issue.
bellofuad34-ctrl commentedon Sep 30, 2026
@bellofuad34-ctrl has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @bellofuad34-ctrl to this issue.
trustosaretin commentedon Sep 30, 2026
@trustosaretin has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @trustosaretin to this issue.
AvatarMiiDe commentedon Sep 30, 2026
@AvatarMiiDe has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @AvatarMiiDe to this issue.
drips-wave commentedon Sep 30, 2026
Congratulations, @trustosaretin! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @trustosaretin: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
feat(webhook): add response size limit and request timeout for dispatch
grantfox-oss commentedon Oct 1, 2026
🎉 This issue has been marked as completed on GrantFox!
@trustosaretin's PR #544 was approved and merged by @DeFiVC.
🏆 @trustosaretin: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (952 total points). Track your full progress on GrantFox.
👏 Great work, @trustosaretin! Keep contributing to ChainLearnOfficial.