wenichats webhook media bodybytes verification

services/tickets/utils.go

@@ -138,6 +138,22 @@ func FetchFile(url string, headers map[string]string) (*File, error) {
 	return &File{URL: url, ContentType: contentType, Body: io.NopCloser(bytes.NewReader(trace.ResponseBody))}, nil
 }
 
+func FetchFileWithMaxSize(url string, headers map[string]string, maxBodyBytes int) (*File, error) {
+	req, _ := httpx.NewRequest("GET", url, nil, headers)
+
+	trace, err := httpx.DoTrace(http.DefaultClient, req, retries, nil, maxBodyBytes)
+	if err != nil {
+		return nil, err
+	}
+	if trace.Response.StatusCode/10 != 2 {
+		return nil, errors.New("fetch returned no-200 response")
+	}
+
+	contentType, _, _ := mime.ParseMediaType(trace.Response.Header.Get("Content-Type"))
+
+	return &File{URL: url, ContentType: contentType, Body: io.NopCloser(bytes.NewReader(trace.ResponseBody))}, nil
+}
+
 // Close closes the given ticket, and creates and queues a closed event
 func Close(ctx context.Context, rt *runtime.Runtime, oa *models.OrgAssets, ticket *models.Ticket, externally bool, l *models.HTTPLogger) error {
 	events, err := models.CloseTickets(ctx, rt, oa, models.NilUserID, []*models.Ticket{ticket}, externally, false, l)

services/tickets/wenichats/web.go

@@ -18,6 +18,26 @@ import (
 	"github.com/pkg/errors"
 )
 
+var (
+	mb5   = 5 * 1024 * 1024
+	mb16  = 16 * 1024 * 1024
+	mb100 = 100 * 1024 * 1024
+)
+
+var mediaTypeMaxBodyBytes = map[string]int{
+	"text/plain":                    mb100,
+	"application/pdf":               mb100,
+	"application/vnd.ms-powerpoint": mb100,
+	"application/msword":            mb100,
+	"application/vnd.ms-excel":      mb100,
+	"application/vnd.openxmlformats-officedocument.wordprocessingml.document":   mb100,
+	"application/vnd.openxmlformats-officedocument.presentationml.presentation": mb100,
+	"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet":         mb100,
+	"audio/aac": mb16, "audio/mp4": mb16, "audio/mpeg": mb16, "audio/amr": mb16,
+	"image/jpeg": mb5, "image/png": mb5,
+	"video/mp4": mb16, "video/3gp": mb16,
+}
+
 func init() {
 	base := "/mr/tickets/types/wenichats"
 	web.RegisterJSONRoute(http.MethodPost, base+"/event_callback/{ticketer:[a-f0-9\\-]+}/{ticket:[a-f0-9\\-]+}", web.WithHTTPLogs(handleEventCallback))
@@ -60,11 +80,25 @@ func handleEventCallback(ctx context.Context, rt *runtime.Runtime, r *http.Reque
 
 		if len(eMsg.Content.Media) > 0 {
 			for _, m := range eMsg.Content.Media {
-				file, err := tickets.FetchFile(m.URL, nil)
+				file, err := tickets.FetchFileWithMaxSize(m.URL, nil, 100*1024*1024)
 				if err != nil {
 					return errors.Wrapf(err, "error fetching ticket file '%s'", m.URL), http.StatusInternalServerError, nil
 				}
 				file.ContentType = m.ContentType
+
+				maxBodyBytes := mediaTypeMaxBodyBytes[file.ContentType]
+				if maxBodyBytes == 0 {
+					maxBodyBytes = mb100
+				}
+				bodyReader := io.LimitReader(file.Body, int64(maxBodyBytes)+1)
+				_, err = io.ReadAll(bodyReader)
+				if err != nil {
+					return err, http.StatusBadRequest, nil
+				}
+				if bodyReader.(*io.LimitedReader).N <= 0 {
+					return errors.Wrapf(err, "unable to send media type %s because response body exceeds %d bytes limit", file.ContentType, maxBodyBytes), http.StatusBadRequest, nil
+				}
+
 				_, err = tickets.SendReply(ctx, rt, ticket, "", []*tickets.File{file})
 				if err != nil {
 					return errors.Wrapf(err, "error on send ticket reply with media '%s'", m.URL), http.StatusInternalServerError, nil