Limit the size of input JSON to Config.server.max-body-size.

vircadia · Dec 30, 2020 · 12f31a4 · 12f31a4
1 parent 37a4dbe
commit 12f31a4
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/src/config.ts b/src/config.ts
@@ -32,6 +32,7 @@ export let Config = {
       'listen-port': 9400,
       'key-file': '',           // if supplied, do https
       'cert-file': '',
+      'max-body-size': 300000,  // maximum body size for input JSON bodies
       'static-base': '/static', // base of static data URL
       'user-config-file': './iamus.json', // startup config over-ride
       'server-version': {       // overlaid with VERSION.json

diff --git a/src/index.ts b/src/index.ts
@@ -72,7 +72,10 @@ initializeConfiguration()
   } ));
 
   // Most of the requests are JSON in an out
-  expr.use(express.json({ 'strict': false }));
+  expr.use(express.json({
+    'strict': false,
+    'limit': Config.server['max-body-size']
+  }));
 
   // There is a problem with some of the domain-server requests that don't
   //    include  the final closing curly-bracket on the JSON. Until that