Security fixes pass #1

src/functions/server/handle-routes.ts

@@ -68,16 +68,16 @@ export default async function ({ req }: Params): Promise<Response> {
 
     const config = module.config as BunextServerRouteConfig | undefined;
 
+    const maxBodyBytes = config?.max_request_body_mb
+        ? config.max_request_body_mb * MBInBytes
+        : ServerDefaultRequestBodyLimitBytes;
+
     const contentLength = req.headers.get("content-length");
 
     if (contentLength) {
         const size = parseInt(contentLength, 10);
 
-        if (
-            (config?.max_request_body_mb &&
-                size > config.max_request_body_mb * MBInBytes) ||
-            size > ServerDefaultRequestBodyLimitBytes
-        ) {
+        if (size > maxBodyBytes) {
             return Response.json(
                 {
                     success: false,
@@ -91,6 +91,26 @@ export default async function ({ req }: Params): Promise<Response> {
                 },
             );
         }
+    } else if (req.method !== "GET" && req.method !== "HEAD") {
+        const body = await req.arrayBuffer();
+        if (body.byteLength > maxBodyBytes) {
+            return Response.json(
+                {
+                    success: false,
+                    msg: "Request Body Too Large!",
+                },
+                {
+                    status: 413,
+                    headers: {
+                        "Content-Type": "application/json",
+                    },
+                },
+            );
+        }
+
+        routeParams.body = JSON.parse(
+            new TextDecoder().decode(body) || "{}",
+        );
     }
 
     const target_module = (module["default"] ||