ai generated solutions to our ai generated problems

webhook.cjs

@@ -43,10 +43,14 @@ const DISCORD_INCLUDE_PATCH = /^(1|true|yes)$/i.test(String(process.env.DISCORD_
 const RESTART_TARGETS = (process.env.PM2_RESTART_TARGETS || 'tssbot-web')
   .split(',')
   .map((target) => target.trim())
+  .filter((target) => /^[A-Za-z0-9_.:-]{1,80}$/.test(target))
   .filter(Boolean)
 const DIST_DIR = path.join(__dirname, 'dist')
 const NEXT_DIST_DIR = path.join(__dirname, 'dist-next')
 const PREVIOUS_DIST_DIR = path.join(__dirname, 'dist-previous')
+const MAX_WEBHOOK_BODY_BYTES = Number(process.env.WEBHOOK_MAX_BODY_BYTES || 1024 * 1024)
+const WEBHOOK_REQUEST_TIMEOUT_MS = Number(process.env.WEBHOOK_REQUEST_TIMEOUT_MS || 30000)
+const WEBHOOK_HEADERS_TIMEOUT_MS = Number(process.env.WEBHOOK_HEADERS_TIMEOUT_MS || 10000)
 const ALLOWED_REFS = new Set(
   (process.env.GITHUB_WEBHOOK_REFS || 'refs/heads/main')
     .split(',')
@@ -420,8 +424,7 @@ async function deploy(push) {
   }
 }
 
-http
-  .createServer((req, res) => {
+const webhookServer = http.createServer((req, res) => {
     if (req.method === 'GET' && req.url === '/health') {
       json(res, 200, { ok: true, deploying, restart_targets: RESTART_TARGETS })
       return
@@ -433,8 +436,20 @@ http
     }
 
     const chunks = []
-    req.on('data', (chunk) => chunks.push(chunk))
+    let size = 0
+    let tooLarge = false
+    req.on('data', (chunk) => {
+      size += chunk.length
+      if (size > MAX_WEBHOOK_BODY_BYTES) {
+        tooLarge = true
+        json(res, 413, { error: 'Webhook body too large' })
+        req.destroy()
+        return
+      }
+      chunks.push(chunk)
+    })
     req.on('end', () => {
+      if (tooLarge) return
       const rawBody = Buffer.concat(chunks)
       const push = safeJsonParse(rawBody)
 
@@ -485,12 +500,16 @@ http
           deploying = false
         })
     })
-  })
-  .listen(PORT, '0.0.0.0', () => {
-    console.log(`tssbot webhook listening on http://localhost:${PORT}/github`)
-    console.log(`restart targets: ${RESTART_TARGETS.join(', ')}`)
-    notifyDiscordRestart()
-  })
+})
+
+webhookServer.requestTimeout = WEBHOOK_REQUEST_TIMEOUT_MS
+webhookServer.headersTimeout = WEBHOOK_HEADERS_TIMEOUT_MS
+
+webhookServer.listen(PORT, '0.0.0.0', () => {
+  console.log(`tssbot webhook listening on http://localhost:${PORT}/github`)
+  console.log(`restart targets: ${RESTART_TARGETS.join(', ')}`)
+  notifyDiscordRestart()
+})
 
 setTimeout(() => {
   console.log('24 hour webhook refresh reached; exiting for PM2 restart')