srojk34 3817ff180d security(raft): enforce body-size limit on chunked requests ... _handle_wake() and _handle_activity() enforced max_body_bytes only via the Content-Length header. A Transfer-Encoding: chunked request (content_length=None) or a spoofed small Content-Length bypassed the cap entirely, letting the actual read be bounded only by aiohttp's implicit 1 MiB client_max_size default (64x the 16 KB default) — the same pattern ec29590a0 just fixed for gateway/platforms/webhook.py. Fix: web.Application(client_max_size=self._max_body_bytes) so aiohttp enforces the cap on every read path including chunked bodies, catch HTTPRequestEntityTooLarge -> 413 on both endpoints (was swallowed into a generic 400), and re-check the actual bytes read as defense in depth. Exposure here is narrower than the webhook adapter (binds to 127.0.0.1 by default and requires the bridge token), but the bypass is otherwise identical.		2026-07-05 13:57:37 -07:00
..
__init__.py	feat(gateway): add Raft bundled platform plugin with activity hooks	2026-06-19 07:52:37 -07:00
adapter.py	security(raft): enforce body-size limit on chunked requests	2026-07-05 13:57:37 -07:00
plugin.yaml	feat(gateway): add Raft bundled platform plugin with activity hooks	2026-06-19 07:52:37 -07:00