From 2b85e78c7835cea1c2ba47f170ec531d55b2f575 Mon Sep 17 00:00:00 2001 From: Quratulain-bilal Date: Wed, 29 Jul 2026 18:49:10 +0500 Subject: [PATCH] fix: cap stdin read at 1 MiB to prevent DoS Unbounded sys.stdin.read() allowed a malicious caller to exhaust memory by sending a multi-gigabyte payload. Cap at 1 MiB and raise typer.Exit if truncated. --- src/specify_cli/commands/event.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/specify_cli/commands/event.py b/src/specify_cli/commands/event.py index 764fde7f6b..1021504024 100644 --- a/src/specify_cli/commands/event.py +++ b/src/specify_cli/commands/event.py @@ -24,8 +24,15 @@ def event_run( """Resolve and run an event-driven command script with stdin payload.""" from ..events import resolve_and_run_event_command - # Read payload from stdin if available - payload = sys.stdin.read() if not sys.stdin.isatty() else "{}" + # Read payload from stdin if available (capped at 1 MiB to prevent DoS) + _MAX_PAYLOAD = 1 * 1024 * 1024 + if not sys.stdin.isatty(): + raw = sys.stdin.read(_MAX_PAYLOAD) + if not sys.stdin.eof: + raise typer.Exit(code=1, message="stdin payload exceeds 1 MiB limit") + payload = raw + else: + payload = "{}" # Run the event command project_root = Path.cwd() # The agent runs events from project root