fix: validate FileSize in NewDataBuilder to prevent OOM DoS (#25710) … · coder/coder@6f5ff1b
@@ -148,21 +148,24 @@ func (s *Session) handleRequests() error {
148148s.Logger.Info(s.Context(), "plan response too large, sending modules as stream",
149149slog.F("size_bytes", len(complete.ModuleFiles)),
150150 )
151-dataUp, chunks := proto.BytesToDataUpload(proto.DataUploadType_UPLOAD_TYPE_MODULE_FILES, complete.ModuleFiles)
152-153-complete.ModuleFiles = nil // sent over the stream
154-complete.ModuleFilesHash = dataUp.DataHash
155-resp.Type = &proto.Response_Plan{Plan: complete}
156-157-err := s.stream.Send(&proto.Response{Type: &proto.Response_DataUpload{DataUpload: dataUp}})
151+dataUp, chunks, err := proto.BytesToDataUpload(proto.DataUploadType_UPLOAD_TYPE_MODULE_FILES, complete.ModuleFiles)
158152if err != nil {
159-complete.Error = fmt.Sprintf("send data upload: %s", err.Error())
153+complete.Error = fmt.Sprintf("prepare module files upload: %s", err.Error())
160154 } else {
161-for i, chunk := range chunks {
162-err := s.stream.Send(&proto.Response{Type: &proto.Response_ChunkPiece{ChunkPiece: chunk}})
163-if err != nil {
164-complete.Error = fmt.Sprintf("send data piece upload %d/%d: %s", i, dataUp.Chunks, err.Error())
165-break
155+complete.ModuleFiles = nil // sent over the stream
156+complete.ModuleFilesHash = dataUp.DataHash
157+resp.Type = &proto.Response_Plan{Plan: complete}
158+159+err := s.stream.Send(&proto.Response{Type: &proto.Response_DataUpload{DataUpload: dataUp}})
160+if err != nil {
161+complete.Error = fmt.Sprintf("send data upload: %s", err.Error())
162+ } else {
163+for i, chunk := range chunks {
164+err := s.stream.Send(&proto.Response{Type: &proto.Response_ChunkPiece{ChunkPiece: chunk}})
165+if err != nil {
166+complete.Error = fmt.Sprintf("send data piece upload %d/%d: %s", i, dataUp.Chunks, err.Error())
167+break
168+ }
166169 }
167170 }
168171 }