fix: prevent webhook memory exhaustion via Content-Length header bypass

[atul-upadhyay-7]

Summary

Replaces the webhook endpoint's two-step payload size validation with a streaming readBodyWithLimit() function that enforces the 1MB size limit during chunked reading, preventing memory exhaustion attacks.

Problem

The previous implementation checked the client-controlled Content-Length header before calling req.text(), which reads the entire body into memory as a JavaScript string. An attacker could:

1. Send Content-Length: 100 (passes the 1MB check)
2. Send a 1GB actual body
3. req.text() allocates ~1-2GB of memory
4. The post-read size check detects the overflow, but the memory is already consumed

This allows a single request to crash the Node.js process via OOM.

Solution

Added readBodyWithLimit() that reads the request body as a ReadableStream in chunks, tracking total bytes consumed. If the limit is exceeded at any point during reading, the stream is cancelled immediately — the full body is never buffered in memory.

async function readBodyWithLimit(
  body: ReadableStream<Uint8Array> | null,
  maxBytes: number
): Promise<{ ok: true; body: string } | { ok: false; status: number; error: string }>

Changes

• app/api/webhook/route.ts — Added readBodyWithLimit() function, replaced Content-Length check + req.text() with streaming read
• app/api/webhook/route.test.ts — Added regression test: "returns 413 when actual body exceeds 1MB despite small Content-Length"

Testing

• All 9 webhook tests pass (including the new vulnerability regression test)
• Lint: 0 errors
• Typecheck: no new errors

Fixes #6135

Human Coded

[vercel]

@atul-upadhyay-7 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

📦 Next.js Bundle Size Report (Gzipped Sizes)

✨ No significant bundle size changes detected.

📊 Summary of Totals

Category	PR Size	Base Size	Difference
Total JS	3697.00 KB	3697.00 KB	0 B
Total CSS	296.58 KB	296.58 KB	0 B

[Aamod-Dev]

Excellent fix. Replacing req.text() with the streaming readBodyWithLimit() chunk reader in app/api/webhook/route.ts effectively neutralizes the out-of-memory vulnerability caused by forged Content-Length headers. Adding the regression test in app/api/webhook/route.test.ts to simulate the mismatch ensures this doesn't regress. Approved!

[github-actions]

🎉 Congratulations @atul-upadhyay-7! Your PR has been successfully merged. 🚀

Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.

⚠️ Important for GSSoC Contributors:
You are strictly advised to join our Discord Server as it is mandatory for all GSSoC participants. All important announcements, point claims, and community discussions happen there.

Keep building! 💻✨