fix(node): enforce maxContentLength for data: URLs

[AmeerAssadi]

Fix (Node): apply maxContentLength to data: URLs with pre-decode size check

• Previously, data: payloads were fully decoded in memory and ignored maxContentLength > possible OOM/DoS.
• Now, if maxContentLength is a finite non-negative value, Axios estimates the decoded size and rejects early when it exceeds the cap.
• Default behavior unchanged (maxContentLength: -1 means unlimited).
• Handles base64 (incl. padding/%3D) and non-base64 (UTF-8 byteLength upper bound).
• No large allocations on the guarded path, error mirrors HTTP oversize handling.

Security: mitigates DoS.
See GHSA: GHSA-4hjh-wcwx-xvwj • CVE-2025-58754.

[AmeerAssadi]

@jasonsaayman plz approve!

[Copilot]

Pull Request Overview

This PR addresses a security vulnerability by enforcing maxContentLength limits on data: URLs to prevent denial-of-service attacks through out-of-memory conditions.

• Adds pre-decode size estimation for data: URLs to check against maxContentLength before decoding
• Implements efficient size calculation for both base64 and non-base64 encoded data without large memory allocations
• Maintains backward compatibility by only enforcing limits when maxContentLength is explicitly set to a finite non-negative value

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[DigitalBrainJS]

Thank you for your contribution. 👍 Although the code looks like it works, it would be nice to add at least one unit test for the utility.

[AmeerAssadi]

@DigitalBrainJS , thanks for the review, I have implemented the changes.
@jasonsaayman FYI

[DigitalBrainJS]

LGTM

[jasonsaayman]

LGTM 🔥

[github-actions]

Hi, @AmeerAssadi! This PR has been published in v1.12.0 release. Thank you for your contribution ❤️!