From 47b7456ef430ccac74dec991605d0010d3898b10 Mon Sep 17 00:00:00 2001 From: Jeff Thompson Date: Fri, 3 Jul 2026 12:12:32 +0200 Subject: [PATCH 1/3] fix(gnoweb): In serveEval, use MaxBytesReader to cap the JSON size Signed-off-by: Jeff Thompson --- gno.land/pkg/gnoweb/feature/playground/handler.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/gno.land/pkg/gnoweb/feature/playground/handler.go b/gno.land/pkg/gnoweb/feature/playground/handler.go index 4bf71d0ff16..2bf61a0ea81 100644 --- a/gno.land/pkg/gnoweb/feature/playground/handler.go +++ b/gno.land/pkg/gnoweb/feature/playground/handler.go @@ -32,6 +32,10 @@ const ( // against memory exhaustion from large or numerous on-chain package files. maxForkCodeSize = 1 << 20 // 1 MiB + // maxEvalBodyBytes caps the eval request body to guard against memory + // exhaustion from oversized JSON payloads. + maxEvalBodyBytes = 1 << 20 // 1 MiB + // defaultCode defines the default code displayed in the code editor. defaultCode = `package main @@ -212,6 +216,8 @@ func (h *Handler) serveEval(w http.ResponseWriter, r *http.Request) { return } + r.Body = http.MaxBytesReader(w, r.Body, maxEvalBodyBytes) + var req evalRequest if err := json.NewDecoder(r.Body).Decode(&req); err != nil { writeJSON(w, http.StatusBadRequest, evalResponse{Error: "invalid request body"}) From 39cc04f88a1f4c18f3fcfd7f89dc48e89ddb0bae Mon Sep 17 00:00:00 2001 From: Jeff Thompson Date: Fri, 3 Jul 2026 12:29:27 +0200 Subject: [PATCH 2/3] fix(gnoweb): In serveEval, limit the size of req.PkgPath and req.Expression Signed-off-by: Jeff Thompson --- gno.land/pkg/gnoweb/feature/playground/handler.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/gno.land/pkg/gnoweb/feature/playground/handler.go b/gno.land/pkg/gnoweb/feature/playground/handler.go index 2bf61a0ea81..c51a5ab883e 100644 --- a/gno.land/pkg/gnoweb/feature/playground/handler.go +++ b/gno.land/pkg/gnoweb/feature/playground/handler.go @@ -36,6 +36,12 @@ const ( // exhaustion from oversized JSON payloads. maxEvalBodyBytes = 1 << 20 // 1 MiB + // maxEvalPkgPathLen and maxEvalExpressionLen bound the eval request fields + // well below maxEvalBodyBytes, rejecting oversized requests before they are + // forwarded to the RPC node. Legitimate values are far smaller. + maxEvalPkgPathLen = 1024 + maxEvalExpressionLen = 64 * 1024 + // defaultCode defines the default code displayed in the code editor. defaultCode = `package main @@ -229,6 +235,11 @@ func (h *Handler) serveEval(w http.ResponseWriter, r *http.Request) { return } + if len(req.PkgPath) > maxEvalPkgPathLen || len(req.Expression) > maxEvalExpressionLen { + writeJSON(w, http.StatusBadRequest, evalResponse{Error: "pkg_path or expression is too long"}) + return + } + // Clean the pkg path. pkgPath := strings.TrimPrefix(req.PkgPath, h.deps.Domain+"/") pkgPath = strings.TrimPrefix(pkgPath, h.deps.Domain) From ee9f7e0b017f49f2813f8634ebf9bebd64823894 Mon Sep 17 00:00:00 2001 From: Jeff Thompson Date: Fri, 3 Jul 2026 13:18:42 +0200 Subject: [PATCH 3/3] Rerun tests